tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow composd to run fd_server

Browse source 
Besides the basic execution that is similar to the (deprecating)
odrefresh case, fd_server also needs to be able to create and change
files in the output directory.

Bug: 205750213
Test: /apex/com.android.compos/bin/composd_cmd forced-odrefresh
      # Saw composd started the fd_server and the VM
Change-Id: Ia66015b72c4bd232c623604be326c7d7145c0a38
This commit is contained in:
Victor Hsieh 2021-11-30 14:21:06 -08:00
parent edf5fa0091
commit 90b7b00391
3 changed files with 21 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
private/compos_fd_server.te
View file

@ -2,18 +2,30 @@
type compos_fd_server, domain, coredomain;
# Allow access to open fds inherited from odrefresh - read inputs, generate outputs
# TODO(b/209008712): Remove once migration is done.
allow compos_fd_server odrefresh:fd use;
allow compos_fd_server apex_art_data_file:file { getattr read };
allow compos_fd_server apex_art_staging_data_file:file { getattr read write };
# Allow access to open fds inherited from composd
allow compos_fd_server composd:fd use;
# Allow creating new files and directory in the staging directory.
allow compos_fd_server apex_art_staging_data_file:dir create_dir_perms;
allow compos_fd_server apex_art_staging_data_file:file create_file_perms;
# Use a pipe to signal readiness
# TODO(b/205750213): Removed odrefresh when we run odrefresh in the VM
allow compos_fd_server odrefresh:fifo_file write;
allow compos_fd_server composd:fifo_file write;
# TODO(b/196109647) - remove this when no longer needed by minijail
allow compos_fd_server odrefresh:fifo_file read;
allow compos_fd_server composd:fifo_file read;
# Create a listening vsock for the VM to connect back to
allow compos_fd_server self:vsock_socket { create_socket_perms_no_ioctl listen accept };
# Only odrefresh can enter the domain via exec
neverallow { domain -odrefresh } compos_fd_server:process transition;
# Only composd and odrefresh can enter the domain via exec
# TODO(b/209008712): Remove odrefresh once migration is done.
neverallow { domain -composd -odrefresh } compos_fd_server:process transition;
neverallow * compos_fd_server:process dyntransition;

6
private/composd.te
View file

@ -22,10 +22,14 @@ allow composd apex_module_data_file:dir search;
allow composd apex_compos_data_file:dir create_dir_perms;
allow composd apex_compos_data_file:file create_file_perms;
# TODO(b/205750213): Removed these when we run odrefresh in the VM
# TODO(b/209008712): Removed these when we run odrefresh in the VM
# Run odrefresh to refresh ART artifacts, and kill it if we need to
domain_auto_trans(composd, odrefresh_exec, odrefresh)
allow composd odrefresh:process sigkill;
# Run fd_server in its own domain, and send SIGTERM when finished.
domain_auto_trans(composd, fd_server_exec, compos_fd_server)
allow composd compos_fd_server:process signal;
# Read ART's properties
get_prop(composd, dalvik_config_prop)

2
private/odrefresh.te
View file

@ -70,7 +70,7 @@ dontaudit odrefresh devpts:chr_file rw_file_perms;
dontaudit odrefresh adbd:unix_stream_socket { getattr read write };
# No other processes should be creating files in the staging area.
neverallow { domain -init -odrefresh } apex_art_staging_data_file:file open;
neverallow { domain -init -odrefresh -compos_fd_server } apex_art_staging_data_file:file open;
# No processes other than init, odrefresh and system_server access
# odrefresh_data_files.