platform_system_sepolicy/public/apexd.te

# apexd -- manager for APEX packages
type apexd, domain;
type apexd_exec, exec_type, file_type, system_file_type;

binder_use(apexd)
add_service(apexd, apex_service)

neverallow { domain -init -apexd -system_server -update_engine } apex_service:service_manager find;
neverallow { domain -init -apexd -system_server -servicemanager -update_engine } apexd:binder call;

neverallow { domain userdebug_or_eng(`-crash_dump') } apexd:process ptrace;
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97 2018-08-17 09:35:42 +02:00			`# apexd -- manager for APEX packages`
			`type apexd, domain;`
			`type apexd_exec, exec_type, file_type, system_file_type;`

			`binder_use(apexd)`
			`add_service(apexd, apex_service)`

Allow update_engine to communicate with apexd When we serve compressed APEX via OTA, we need to ensure device has enough space to decompress them during boot. In order to do that, update_engine will need to pass metadata about the OTA to apexd so that it can make calculation about space requirments. Update engine in return will display warning to user if the space requirement can't be fulfilled. Bug: 172911822 Test: manual Change-Id: Idff25ac8e5165da70c539edcf6b292e04299a5c6 2021-02-18 20:55:31 +01:00			`neverallow { domain -init -apexd -system_server -update_engine } apex_service:service_manager find;`
			`neverallow { domain -init -apexd -system_server -servicemanager -update_engine } apexd:binder call;`
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97 2018-08-17 09:35:42 +02:00
Sepolicy: Allow crash_dump to ptrace apexd in userdebug In userdebug, for better diagnostics, allow crash_dump to "connect to" apexd. Considering apexd is quite powerful, user devices remain restricted. Bug: 118771487 Test: m Change-Id: Id42bd2ad7505cd5578138bfccd8840acba9a334d 2019-03-05 17:36:36 +01:00			neverallow { domain userdebug_or_eng(`-crash_dump') } apexd:process ptrace;