tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Add /data/fonts/files directory"

Browse source
This commit is contained in:
Seigo Nonaka 2021-01-25 05:47:03 +00:00 committed by Gerrit Code Review
commit 1237d422ef
5 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
private/app.te
View file

@ -63,6 +63,10 @@ get_prop(appdomain, camera_calibration_prop)
# Allow to read db.log.detailed, db.log.slow_query_threshold*
get_prop(appdomain, sqlite_log_prop)
# Allow font file read by apps.
allow appdomain font_data_file:file r_file_perms;
allow appdomain font_data_file:dir r_dir_perms;
# Read /data/misc/apexdata/com.android.art
allow appdomain { apex_art_data_file apex_module_data_file }:dir search;
allow appdomain apex_art_data_file:file r_file_perms;

1
private/compat/30.0/30.0.ignore.cil
View file

@ -26,6 +26,7 @@
dumpstate_tmpfs
framework_watchdog_config_prop
game_service
font_data_file
gki_apex_prepostinstall
gki_apex_prepostinstall_exec
hal_authsecret_service

3
private/file.te
View file

@ -41,3 +41,6 @@ type apex_art_data_file, file_type, data_file_type, core_data_file_type;
# /data/misc/apexdata/com.android.art/staging
type apex_art_staging_data_file, file_type, data_file_type, core_data_file_type;
# /data/font/files
type font_data_file, file_type, data_file_type, core_data_file_type;

1
private/file_contexts
View file

@ -551,6 +551,7 @@
# to avoid restorecon conflicts
/data/rollback/\d+/[^/]+/.*\.apk u:object_r:apk_data_file:s0
/data/rollback/\d+/[^/]+/.*\.apex u:object_r:staging_data_file:s0
/data/fonts/files(/.*)? u:object_r:font_data_file:s0
# Misc data
/data/misc/adb(/.*)? u:object_r:adb_keys_file:s0

11
private/system_server.te
View file

@ -1045,6 +1045,13 @@ userdebug_or_eng(`
# Watchdog reads sysprops framework_watchdog.fatal_* to handle watchdog timeout loop.
get_prop(system_server, framework_watchdog_config_prop)
# Font files are written by system server
allow system_server font_data_file:file create_file_perms;
allow system_server font_data_file:dir create_dir_perms;
# Allow system process to setup fs-verity for font files
allowxperm system_server font_data_file:file ioctl FS_IOC_ENABLE_VERITY;
###
### Neverallow rules
###
@ -1285,3 +1292,7 @@ neverallow {
# BINDER_GET_FROZEN_INFO is used by system_server to determine the state of a frozen binder
# interface
neverallowxperm { domain -system_server } binder_device:chr_file ioctl { BINDER_FREEZE BINDER_GET_FROZEN_INFO };
# Only system server can write the font files.
neverallow { domain -init -system_server } font_data_file:file no_w_file_perms;
neverallow { domain -init -system_server } font_data_file:dir no_w_dir_perms;