tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/apex/com.android.art.debug-file_contexts

14 lines
649 B
Text
Raw Normal View History

Move file_contexts for APEXes to under /system/sepolicy For centralized development of sepolices, file_contexts files for APEXes are all moved to under /system/seplicy. Bug: 119034475 Bug: 113373927 Test: m apex.test com.android.tzdata com.android.runtime com.android.media Change-Id: I9bf4874793db4dbdb75cbd759ae95f72d7281007
2018-11-09 22:51:49 +01:00
#############################
# System files
#
Sepolicy: Add base runtime APEX postinstall policies Add art_apex_postinstall domain that is allowed to move precreated AoT artifacts from /data/ota. Bug: 125474642 Test: m Change-Id: Id674e202737155a4ee31187f096d1dd655001fdd
2019-02-21 19:03:07 +01:00
(/.*)? u:object_r:system_file:s0
Allow the ART boot oneshot service to configure ART config properties. Test: See commit 2691baf9d4f8086902d46b2e340a6e5464857b90 in art/ (ag/23125728) Bug: 281850017 Change-Id: I14baf55d07ad559294bd3b7d9562230e78201d25 (cherry picked from commit 3d7093fd7bc1dffa49db5436081c6f4e49947f26) Merged-In: I14baf55d07ad559294bd3b7d9562230e78201d25
2023-05-10 17:52:39 +02:00
/bin/art_boot u:object_r:art_boot_exec:s0
Update SELinux policy for app compilation CUJ. - Adapt installd rules for app compilation. - Add profman rules for checking the profile before compilation. This is new behavior compared to installd. Bug: 229268202 Test: - 1. adb shell pm art optimize-package -m speed-profile -f \ com.google.android.youtube 2. See no SELinux denial. Change-Id: Idfe1ccdb1b27fd275fdf912bc8d005551f89d4fc
2022-07-19 22:29:31 +02:00
/bin/art_exec u:object_r:art_exec_exec:s0
Reconcile `file_contexts` files for Release and Debug ART APEXes. Replicate change https://android-review.googlesource.com/c/1663786/2/apex/com.android.art-file_contexts in `apex/com.android.art.debug-file_contexts`. Test: Patch this commit into a tree that uses `artd` (only internal ones at the moment) and run the following command on a device running the Debug ART APEX: adb shell pm art \ get-optimization-status com.google.android.youtube Change-Id: If0b10b585778e8b585e76b2a4512a2f23facd22e
2022-07-29 15:57:33 +02:00
/bin/artd u:object_r:artd_exec:s0
Fix sepolicy of ART module. The dex2oat debug binary ends with the bitness. Bug: 160137482 Test: adb shell cmd package bg-dexopt-job Change-Id: If78cd100eb1c0245e425361d56e1936f1c6c98a6
2020-07-06 11:15:39 +02:00
/bin/dex2oat(d)?(32|64)? u:object_r:dex2oat_exec:s0
Update sepolicy for service dexopt_chroot_setup and artd_pre_reboot. Bug: 311377497 Test: manual - Call getDexoptChrootSetupServiceRegisterer().waitForService() Test: manual - Set up a chroot environment and call getArtdPreRebootServiceRegisterer().waitForService() Change-Id: I50b5f7f858dab37f05174cb9787f64303d50d083
2023-10-18 18:03:20 +02:00
/bin/dexopt_chroot_setup u:object_r:dexopt_chroot_setup_exec:s0
Sepolicy: Add base runtime APEX postinstall policies Add art_apex_postinstall domain that is allowed to move precreated AoT artifacts from /data/ota. Bug: 125474642 Test: m Change-Id: Id674e202737155a4ee31187f096d1dd655001fdd
2019-02-21 19:03:07 +01:00
/bin/dexoptanalyzer(d)? u:object_r:dexoptanalyzer_exec:s0
Permissions for odrefresh and /data/misc/apexdata/com.android.art odrefresh is the process responsible for checking and creating ART compilation artifacts that live in the ART APEX data directory (/data/misc/apexdata/com.android.art). There are two types of change here: 1) enabling odrefresh to run dex2oat and write updated boot class path and system server AOT artifacts into the ART APEX data directory. 2) enabling the zygote and assorted diagnostic tools to use the updated AOT artifacts. odrefresh uses two file contexts: apex_art_data_file and apex_art_staging_data_file. When odrefresh invokes dex2oat, the generated files have the apex_art_staging_data_file label (which allows writing). odrefresh then moves these files from the staging area to their installation area and gives them the apex_art_data_file label. Bug: 160683548 Test: adb root && adb shell /apex/com.android.art/bin/odrefresh Change-Id: I9fa290e0c9c1b7b82be4dacb9f2f8cb8c11e4895
2020-10-16 16:29:55 +02:00
/bin/odrefresh u:object_r:odrefresh_exec:s0
Sepolicy: Add base runtime APEX postinstall policies Add art_apex_postinstall domain that is allowed to move precreated AoT artifacts from /data/ota. Bug: 125474642 Test: m Change-Id: Id674e202737155a4ee31187f096d1dd655001fdd
2019-02-21 19:03:07 +01:00
/bin/profman(d)? u:object_r:profman_exec:s0
/lib(64)?(/.*)? u:object_r:system_lib_file:s0
Reference in a new issue Copy permalink