tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "sepolicy: Fix renderscript driver lookup" into oc-dev

Browse source
This commit is contained in:
TreeHugger Robot 2017-04-10 17:45:52 +00:00 committed by Android (Google) Code Review
commit b28ef52688
2 changed files with 16 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
private/app.te
View file

@ -93,6 +93,16 @@ allow { appdomain -ephemeral_app -untrusted_v2_app } toolbox_exec:file rx_file_p
# Renderscript needs the ability to read directories on /system
allow appdomain system_file:dir r_dir_perms;
allow appdomain system_file:lnk_file { getattr open read };
# Renderscript specific permissions to open /system/vendor/lib64.
not_full_treble(`
allow appdomain vendor_file_type:dir r_dir_perms;
allow appdomain vendor_file_type:lnk_file { getattr open read };
')
full_treble_only(`
# For looking up Renderscript vendor drivers
allow { appdomain -isolated_app } vendor_file:dir { open read };
')
# Allow apps access to /vendor/app except for privileged
# apps which cannot be in /vendor.

8
public/domain.te
View file

@ -129,8 +129,12 @@ allow domain vendor_configs_file:dir r_dir_perms;
allow domain vendor_configs_file:file { read open getattr };
full_treble_only(`
# This is required "most likely" for LD_LIBRARY_PATH
# (b/36681074)
# Allow all domains to be able to follow /system/vendor symlink
allow domain vendor_file:lnk_file { getattr open read };
# This is required to be able to search & read /vendor/lib64
# in order to lookup vendor libraries. The 'execute' permission
# for coredomains is granted *only* for same process HALs
allow domain vendor_file:dir { getattr search };
# Allow reading and executing out of /vendor to all vendor domains