tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Allow odrefresh to use userfaultfd" am: e82248bcb0

Browse source 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2040965

Change-Id: I1a571ae2eda151b3dbc037fbe1d1a2f11d004eb9
This commit is contained in:
Victor Hsieh 2022-03-24 15:30:56 +00:00 committed by Automerger Merge Worker
commit 73dbe7b5e8
1 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
microdroid/system/private/odrefresh.te
View file

@ -8,6 +8,14 @@ domain_auto_trans(odrefresh, dex2oat_exec, dex2oat)
# Allow odrefresh to kill dex2oat if compilation times out.
allow odrefresh dex2oat:process sigkill;
userfaultfd_use(odrefresh)
# Allow odrefresh to read /apex/apex-info-list.xml to gather information of
# the current APEXes.
allow odrefresh apex_info_file:file r_file_perms;
# The policies above are mirrored from Android's, while the below are tailored for using in CompOS.
# Allow odrefresh to read/write/lookup files/directories on authfs.
allow odrefresh authfs_fuse:file create_file_perms;
allow odrefresh authfs_fuse:dir create_dir_perms;
@ -15,10 +23,6 @@ allow odrefresh authfs_fuse:dir create_dir_perms;
# Allow odrefresh to check the parent directory exists.
allow odrefresh authfs_data_file:dir { search getattr };
# Allow odrefresh to read /apex/apex-info-list.xml to gather information of
# the current APEXes.
allow odrefresh apex_info_file:file r_file_perms;
# Minijail uses pipe for the parent process to signal the child (as a fallback
# mechanism, since Android does not support minijail's preload).
# TODO(196109647): We can probably remove this once the minijail preload is