tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Allow compos to run derive_classpath"

Browse source
This commit is contained in:
Alan Stokes 2022-01-06 15:57:33 +00:00 committed by Gerrit Code Review
commit 3b0f637ad0
2 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
microdroid/system/private/compos.te
View file

@ -26,6 +26,14 @@ allow compos authfs_fuse:file create_file_perms;
# Allow locating the authfs mount directory.
allow compos authfs_data_file:dir search;
# Run derive_classpath in our domain
allow compos derive_classpath_exec:file rx_file_perms;
allow compos apex_mnt_dir:dir r_dir_perms;
# Ignore harmless denials on /proc/self/fd
dontaudit compos self:dir write;
# See b/35323867#comment3
dontaudit compos self:global_capability_class_set dac_override;
# Allow domain transition into odrefresh and dex2oat.
# TODO(b/209008712): Remove dex2oat once the migration is done.
domain_auto_trans(compos, odrefresh_exec, odrefresh)

1
microdroid/system/private/derive_classpath.te Normal file
View file

@ -0,0 +1 @@
type derive_classpath_exec, system_file_type, exec_type, file_type;