tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/composd.te

37 lines
1.2 KiB
Text
Raw Normal View History

Initial sepolicy for composd Add what we need to allow composd to run and expose an AIDL service. Also delete the policy for compsvc; we never access it in the host now, and the real policy is in microdroid. Retain the compos_exec type, since it is referenced in the APEX sepolicy. Bug: 186126194 Test: adb shell cmd -w android.system.composd; no denials. Change-Id: I5f06b2b01852cdebd2d67009b363ec08b17ce33a
2021-09-09 18:08:15 +02:00
type composd, domain, coredomain;
type composd_exec, system_file_type, exec_type, file_type;
Split composd's service in two They are served by the same process but have different clients: - the main interface is exposed to system server; - the internal interface is called by odrefresh when spawned by composd. Test: compos_cmd forced-compile-test Bug: 199147668 Change-Id: Ie1561b7700cf633d7d5c8df68ff58797a8d8bced
2021-11-19 18:33:34 +01:00
# Host dynamic AIDL services
Initial sepolicy for composd Add what we need to allow composd to run and expose an AIDL service. Also delete the policy for compsvc; we never access it in the host now, and the real policy is in microdroid. Retain the compos_exec type, since it is referenced in the APEX sepolicy. Bug: 186126194 Test: adb shell cmd -w android.system.composd; no denials. Change-Id: I5f06b2b01852cdebd2d67009b363ec08b17ce33a
2021-09-09 18:08:15 +02:00
init_daemon_domain(composd)
binder_use(composd)
add_service(composd, compos_service)
Allow system server to access composd. Also allow composd to kill odrefresh (it execs it); this is necessary for cancel() to work. Bug: 199147668 Test: manual Change-Id: I233cac50240130da2f4e99f452697c1162c10c40
2021-10-19 17:50:24 +02:00
# Call back into system server
binder_call(composd, system_server)
Initial sepolicy for composd Add what we need to allow composd to run and expose an AIDL service. Also delete the policy for compsvc; we never access it in the host now, and the real policy is in microdroid. Retain the compos_exec type, since it is referenced in the APEX sepolicy. Bug: 186126194 Test: adb shell cmd -w android.system.composd; no denials. Change-Id: I5f06b2b01852cdebd2d67009b363ec08b17ce33a
2021-09-09 18:08:15 +02:00
# Start a VM
virtualizationservice_use(composd)
Allow composd to delete odrefresh target files We need to remove any existing files (and the directory) to allow odrefresh in the VM to re-create them via authfs. But we don't need, and shouldn't have, any other access to them. Bug: 210460516 Test: composd_cmd async-odrefresh Change-Id: Iaafe33934146a6b8dda7c28cc1239c2eed167379
2021-12-16 15:31:14 +01:00
# Prepare staging directory for odrefresh
Allow composd to create odrefresh staging directory composd in responsible to prepare the staging directory for odrefresh (in the VM) to write the output to. Temporary output should be put in a staged directory with a temporary apex_art_staging_data_file context. When a compilation is finished, the files can then be moved to the final directory with the final context. Bug: 205750213 Test: No denials Change-Id: I9444470b31518242c1bb84fc755819d459d21d68
2021-12-04 01:46:18 +01:00
allow composd apex_art_data_file:dir { create_dir_perms relabelfrom };
allow composd apex_art_staging_data_file:dir { create_dir_perms relabelto };
Allow composd to delete ART staging files If the directory is non-empty when we start we need to delete everything in it, but didn't have enough access: avc: denied { getattr } for path="/data/misc/apexdata/com.android.art/staging/boot-framework.art" dev="dm-37" ino=57755 scontext=u:r:composd:s0 tcontext=u:object_r:apex_art_staging_data_file:s0 tclass=file permissive=0 Bug: 205750213 Test: create files in staging/, composd_cmd test-compile Change-Id: I3a66db7f5fbff82abcf547cb1c2b24e9c53ab158
2021-12-21 15:43:39 +01:00
allow composd apex_art_staging_data_file:file { getattr unlink };
Allow composd to create odrefresh staging directory composd in responsible to prepare the staging directory for odrefresh (in the VM) to write the output to. Temporary output should be put in a staged directory with a temporary apex_art_staging_data_file context. When a compilation is finished, the files can then be moved to the final directory with the final context. Bug: 205750213 Test: No denials Change-Id: I9444470b31518242c1bb84fc755819d459d21d68
2021-12-04 01:46:18 +01:00
Allow composd to delete odrefresh target files We need to remove any existing files (and the directory) to allow odrefresh in the VM to re-create them via authfs. But we don't need, and shouldn't have, any other access to them. Bug: 210460516 Test: composd_cmd async-odrefresh Change-Id: Iaafe33934146a6b8dda7c28cc1239c2eed167379
2021-12-16 15:31:14 +01:00
# Delete files in the odrefresh target directory
allow composd apex_art_data_file:file unlink;
Initial sepolicy for composd Add what we need to allow composd to run and expose an AIDL service. Also delete the policy for compsvc; we never access it in the host now, and the real policy is in microdroid. Retain the compos_exec type, since it is referenced in the APEX sepolicy. Bug: 186126194 Test: adb shell cmd -w android.system.composd; no denials. Change-Id: I5f06b2b01852cdebd2d67009b363ec08b17ce33a
2021-09-09 18:08:15 +02:00
# Access our APEX data files
allow composd apex_module_data_file:dir search;
allow composd apex_compos_data_file:dir create_dir_perms;
allow composd apex_compos_data_file:file create_file_perms;
Allow composd to run odrefresh Also allow odrefresh to run pvm_exec to talk to the CompOS VM. And I moved the dontaudit & neverallow rules to the bottom while I was here. Bug: 186126194 Test: adb shell apex/com.android.compos/bin/composd_cmd Change-Id: I6f06dd6467a8eb59123d06c7179a86d9287e7f2f
2021-09-15 15:28:12 +02:00
Allow composd to run fd_server Besides the basic execution that is similar to the (deprecating) odrefresh case, fd_server also needs to be able to create and change files in the output directory. Bug: 205750213 Test: /apex/com.android.compos/bin/composd_cmd forced-odrefresh # Saw composd started the fd_server and the VM Change-Id: Ia66015b72c4bd232c623604be326c7d7145c0a38
2021-11-30 23:21:06 +01:00
# Run fd_server in its own domain, and send SIGTERM when finished.
domain_auto_trans(composd, fd_server_exec, compos_fd_server)
allow composd compos_fd_server:process signal;
Allow composd to read ART's properties Only ro.zygote is currently used, though we'll need to a few others of the same property context. Bug: 205750213 Test: composd_cmd forced-odrefresh # less SELinux denial Change-Id: I2efbbc1637142f522a66c47bdd17471c4bde227a
2021-12-02 00:25:23 +01:00
# Read ART's properties
get_prop(composd, dalvik_config_prop)
Allow composd to delete odrefresh target files We need to remove any existing files (and the directory) to allow odrefresh in the VM to re-create them via authfs. But we don't need, and shouldn't have, any other access to them. Bug: 210460516 Test: composd_cmd async-odrefresh Change-Id: Iaafe33934146a6b8dda7c28cc1239c2eed167379
2021-12-16 15:31:14 +01:00
# We never create any artifact files directly
neverallow composd apex_art_data_file:file ~unlink;
Reference in a new issue Copy permalink