tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Allow odrefresh to relabel staging files to apex_art_data_file." into main

Browse source
This commit is contained in:
Treehugger Robot 2024-03-19 16:27:27 +00:00 committed by Gerrit Code Review
commit 1b45a0af5e
1 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
private/odrefresh.te
View file

@ -5,7 +5,7 @@ type odrefresh_exec, system_file_type, exec_type, file_type;
# Allow odrefresh to create files and directories for on device signing.
allow odrefresh apex_module_data_file:dir { getattr search };
allow odrefresh apex_art_data_file:dir { create_dir_perms relabelfrom };
allow odrefresh apex_art_data_file:file create_file_perms;
allow odrefresh apex_art_data_file:file { create_file_perms relabelto } ;
# Allow odrefresh to create data files (typically for metrics before statsd starts).
allow odrefresh odrefresh_data_file:dir create_dir_perms;
@ -16,7 +16,7 @@ userfaultfd_use(odrefresh)
# Staging area labels (/data/misc/apexdata/com.android.art/staging). odrefresh
# sets up files here and passes file descriptors for dex2oat to write to.
allow odrefresh apex_art_staging_data_file:dir { create_dir_perms relabelto };
allow odrefresh apex_art_staging_data_file:file create_file_perms;
allow odrefresh apex_art_staging_data_file:file { create_file_perms relabelfrom };
# Run dex2oat in its own sandbox.
domain_auto_trans(odrefresh, dex2oat_exec, dex2oat)
@ -58,3 +58,10 @@ neverallow { domain -init -odrefresh -compos_fd_server } apex_art_staging_data_f
# odrefresh_data_files.
neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:dir *;
neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:file *;
# Read access to SELinux context files, for restorecon.
allow odrefresh file_contexts_file:file r_file_perms;
allow odrefresh seapp_contexts_file:file r_file_perms;
# Check validity of SELinux context, for restorecon.
selinux_check_context(odrefresh)