From ecc09871bae469fe8e57f395f8627e391fd6f9a9 Mon Sep 17 00:00:00 2001 From: Jiyong Park Date: Fri, 12 Oct 2018 19:21:12 +0900 Subject: [PATCH] Allow apexd to realpath(3) on apex_key_files apexd uses realpath(3) to ensure that the public key file that will use is under /system/etc/security/apex directory. In order to support it, allow apexd to getattr on apex_key_files. The canonicalization is required because the key name from APEX might be wrong. For example, if the key name from an APEX is '../../some/path' then apexd will use '/system/etc/security/apex/../../some/path' as the public key file, which is incorrect. Bug: 115721587 Test: m apex.test; m /apex/com.android.example.apex@1 exists Change-Id: I6dc5efa0de369f8497e4f6526e0164e2de589c67 --- private/apexd.te | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/private/apexd.te b/private/apexd.te index adf6c9758..32efb9882 100644 --- a/private/apexd.te +++ b/private/apexd.te @@ -3,7 +3,7 @@ typeattribute apexd coredomain; init_daemon_domain(apexd) # Read /system/etc/security/apex_debug_key -allow apexd apex_key_file:dir search; +allow apexd apex_key_file:dir { search getattr }; allow apexd apex_key_file:file r_file_perms; # Allow reading and writing of APEX files in the APEX data dir