tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow odrefresh to relabel staging files to apex_art_data_file.

Browse source 
This will allow odrefresh to move files from staging dir to output dir
instead of copying.

Test: -
  1. Patch https://r.android.com/2991838
  2. atest odsign_e2e_tests_full
Change-Id: I8fec4db3ff720f84a58e41439089ea55e53301b4
This commit is contained in:
Jiakai Zhang 2024-03-15 16:39:13 +00:00
parent 3230efb5cf
commit 8d24e01ba8
1 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
private/odrefresh.te
View file

@ -5,7 +5,7 @@ type odrefresh_exec, system_file_type, exec_type, file_type;
# Allow odrefresh to create files and directories for on device signing.
allow odrefresh apex_module_data_file:dir { getattr search };
allow odrefresh apex_art_data_file:dir { create_dir_perms relabelfrom };
allow odrefresh apex_art_data_file:file create_file_perms;
allow odrefresh apex_art_data_file:file { create_file_perms relabelto } ;
# Allow odrefresh to create data files (typically for metrics before statsd starts).
allow odrefresh odrefresh_data_file:dir create_dir_perms;
@ -16,7 +16,7 @@ userfaultfd_use(odrefresh)
# Staging area labels (/data/misc/apexdata/com.android.art/staging). odrefresh
# sets up files here and passes file descriptors for dex2oat to write to.
allow odrefresh apex_art_staging_data_file:dir { create_dir_perms relabelto };
allow odrefresh apex_art_staging_data_file:file create_file_perms;
allow odrefresh apex_art_staging_data_file:file { create_file_perms relabelfrom };
# Run dex2oat in its own sandbox.
domain_auto_trans(odrefresh, dex2oat_exec, dex2oat)
@ -58,3 +58,10 @@ neverallow { domain -init -odrefresh -compos_fd_server } apex_art_staging_data_f
# odrefresh_data_files.
neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:dir *;
neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:file *;
# Read access to SELinux context files, for restorecon.
allow odrefresh file_contexts_file:file r_file_perms;
allow odrefresh seapp_contexts_file:file r_file_perms;
# Check validity of SELinux context, for restorecon.
selinux_check_context(odrefresh)