tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Allow odrefresh to use userfaultfd"

Browse source
This commit is contained in:
Victor Hsieh 2022-03-24 15:15:17 +00:00 committed by Gerrit Code Review
commit e82248bcb0
1 changed files with 8 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
microdroid/system/private/odrefresh.te
View file

@ -8,6 +8,14 @@ domain_auto_trans(odrefresh, dex2oat_exec, dex2oat)
# Allow odrefresh to kill dex2oat if compilation times out. # Allow odrefresh to kill dex2oat if compilation times out.
allow odrefresh dex2oat:process sigkill; allow odrefresh dex2oat:process sigkill;
userfaultfd_use(odrefresh)
# Allow odrefresh to read /apex/apex-info-list.xml to gather information of
# the current APEXes.
allow odrefresh apex_info_file:file r_file_perms;
# The policies above are mirrored from Android's, while the below are tailored for using in CompOS.
# Allow odrefresh to read/write/lookup files/directories on authfs. # Allow odrefresh to read/write/lookup files/directories on authfs.
allow odrefresh authfs_fuse:file create_file_perms; allow odrefresh authfs_fuse:file create_file_perms;
allow odrefresh authfs_fuse:dir create_dir_perms; allow odrefresh authfs_fuse:dir create_dir_perms;
@ -15,10 +23,6 @@ allow odrefresh authfs_fuse:dir create_dir_perms;
# Allow odrefresh to check the parent directory exists. # Allow odrefresh to check the parent directory exists.
allow odrefresh authfs_data_file:dir { search getattr }; allow odrefresh authfs_data_file:dir { search getattr };
# Allow odrefresh to read /apex/apex-info-list.xml to gather information of
# the current APEXes.
allow odrefresh apex_info_file:file r_file_perms;
# Minijail uses pipe for the parent process to signal the child (as a fallback # Minijail uses pipe for the parent process to signal the child (as a fallback
# mechanism, since Android does not support minijail's preload). # mechanism, since Android does not support minijail's preload).
# TODO(196109647): We can probably remove this once the minijail preload is # TODO(196109647): We can probably remove this once the minijail preload is