tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow adbd to pull apexes from /data/apex/active

Browse source 
Test: adb pull /data/apex/active/com.android.apex.cts.shim@v2.apex
Bug: 184886365
Change-Id: Ibaac390a99e65a8b388d3c62761d96ec8f8e0846
This commit is contained in:
Nikita Ioffe 2021-04-12 23:16:33 +01:00
parent 4ea9b0b9df
commit 17bd4dda4a
2 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
private/adbd.te
View file

@ -209,6 +209,10 @@ allow adbd shell:fd use;
allow adbd vendor_apex_file:dir search; allow adbd vendor_apex_file:dir search;
allow adbd vendor_apex_file:file r_file_perms; allow adbd vendor_apex_file:file r_file_perms;
# Allow adb pull of updated apex files in /data/apex/active.
allow adbd apex_data_file:dir search;
allow adbd staging_data_file:file r_file_perms;
### ###
### Neverallow rules ### Neverallow rules
### ###

2
private/domain.te
View file

@ -201,7 +201,7 @@ neverallow {
# do not change between system_server staging the files and apexd processing # do not change between system_server staging the files and apexd processing
# the files. # the files.
neverallow { domain -init -system_server -apexd -installd -iorap_inode2filename -priv_app } staging_data_file:dir *; neverallow { domain -init -system_server -apexd -installd -iorap_inode2filename -priv_app } staging_data_file:dir *;
neverallow { domain -init -system_app -system_server -apexd -kernel -installd -iorap_inode2filename -priv_app } staging_data_file:file *; neverallow { domain -init -system_app -system_server -apexd -adbd -kernel -installd -iorap_inode2filename -priv_app } staging_data_file:file *;
neverallow { domain -init -system_server -installd} staging_data_file:dir no_w_dir_perms; neverallow { domain -init -system_server -installd} staging_data_file:dir no_w_dir_perms;
# apexd needs the link and unlink permissions, so list every `no_w_file_perms` # apexd needs the link and unlink permissions, so list every `no_w_file_perms`
# except for `link` and `unlink`. # except for `link` and `unlink`.