Commit graph

15 commits

Author SHA1 Message Date
Victor Hsieh
88d93b984a Remove odrefresh privileges no longer needed for CompOS
Bug: 210998077
Test: m; TH
Change-Id: I4188a52c42ede9fb248b889596b91c965696fb2d
2022-01-18 12:56:27 -08:00
Victor Hsieh
6f6815efde Remove compos_internal_service
Bug: 210998077
Test: m; TH
Change-Id: Id3c7fcab56de5f71b00e21bd53829b2471e07d77
2022-01-18 12:51:55 -08:00
Victor Hsieh
90b7b00391 Allow composd to run fd_server
Besides the basic execution that is similar to the (deprecating)
odrefresh case, fd_server also needs to be able to create and change
files in the output directory.

Bug: 205750213
Test: /apex/com.android.compos/bin/composd_cmd forced-odrefresh
      # Saw composd started the fd_server and the VM
Change-Id: Ia66015b72c4bd232c623604be326c7d7145c0a38
2021-12-07 08:07:50 -08:00
Alan Stokes
8788f7afe2 Split composd's service in two
They are served by the same process but have different clients:
- the main interface is exposed to system server;
- the internal interface is called by odrefresh when spawned by composd.

Test: compos_cmd forced-compile-test
Bug: 199147668
Change-Id: Ie1561b7700cf633d7d5c8df68ff58797a8d8bced
2021-11-22 09:36:45 +00:00
Alan Stokes
ec4a90f59c Enable odrefresh to work with composd.
composd spawns odrefresh in its usual domain. odrefresh then spawns
fd_server in a different domain, and makes binder calls back to
composd to perform individual compilation steps.

fd_server is fairly generic, and part of the virt APEX, but this
instance is specific to composd (e.g. it has access to ART files), so
I named the domain composd_fd_server.

Bug: 186126194
Test: Run composd_cmd, artifacts generated
Change-Id: I5a431dd00b5b396a67021c618fc6edcfb25aa21b
2021-09-23 12:03:30 +01:00
Alan Stokes
d3438b0f3c Allow composd to run odrefresh
Also allow odrefresh to run pvm_exec to talk to the CompOS VM.

And I moved the dontaudit & neverallow rules to the bottom while I was here.

Bug: 186126194
Test: adb shell apex/com.android.compos/bin/composd_cmd
Change-Id: I6f06dd6467a8eb59123d06c7179a86d9287e7f2f
2021-09-16 11:14:54 +01:00
Orion Hodson
522bcbe9e6 odrefresh: add permission to sigkill child processes
Bug: 177432913
Bug: 196969404
Test: manually decrease odrefresh compilation timeout, no avc denied
Change-Id: Ic89dcdb64974ac00c83504d876a94d8b5c6b2a29
2021-08-17 19:08:08 +01:00
Calin Juravle
0b2ca6c22c Enable ART properties modularization
ART is becoming a module and we need to be able to add new properties
without modifying the non updatable part of the platform:

- convert ART properties to use prefix in the namespace of
[ro].dalvik.vm.
- enable appdomain and coredomain to read device_config properties
that configure ART

Test: boot
Bug: 181748174
Change-Id: Id23ff78474dba947301e1b6243a112b0f5b4a832
2021-06-01 16:14:55 -07:00
Nicolas Geoffray
6a311471a6 Allow boot animation to update boot status.
This CL was missed from the topic:
https://android-review.googlesource.com/q/topic:bootanim-percent

Test: update ART module, see animation go to 100%
Bug: 184881321
Change-Id: I59706718af11751a7e1f4b5ab1ff2793f554fb19
2021-04-28 15:17:09 +01:00
Nicolas Geoffray
efef689e36 Allow odrefresh to update the boot animation status.
Test: m
Bug: 160683548
Change-Id: Ic7d3fe64a0ee54d6989e2a1b67e9eb0f6666b3a1
2021-04-16 09:26:38 +01:00
Orion Hodson
7c6b3eb963 Add odrefresh_data_file for odrefresh metrics
Metrics are written to /data/misc/odrefresh by odrefresh during early
boot, then native code in ART system_server initialization passes them
to statsd and deletes the metrics files. This hand-off is necessary
because statsd does not start until after odsign and odrefresh have run.

Bug: 169925964
Test: manual
Change-Id: I8054519a714907819886dd6e5e78f3b5796d0898
2021-04-09 15:50:28 +01:00
Lokesh Gidra
06edcd8250 Add SELinux policy for using userfaultfd
ART runtime will be using userfaultfd for a new heap compaction
algorithm. After enabling userfaultfd in android kernels (with SELinux
support), the feature needs policy that allows { create ioctl read }
operations on userfaultfd file descriptors.

Bug: 160737021
Test: Manually tested by exercising userfaultfd ops in ART
Change-Id: I9ccb7fa9c25f91915639302715f6197d42ef988e
2021-03-17 04:57:22 -07:00
Orion Hodson
46c2aad205 odrefresh.te: use create_rw_perms for apex_art_data_file:file
odrefresh should setattr on generated artifacts. This is apparent now
that it is now launched from init which sets a restrictive umask on
forked processes.

Bug: 181397437
Test: manually apply ART APEX update
Change-Id: I8e30c1ef1e42b3b68b3c07e860abb4dc2728e275
2021-03-01 15:33:31 +00:00
Martijn Coenen
6afdb72cbb SELinux policy for on-device signing binary.
Bug: 165630556
Test: no denials on boot
Change-Id: I9d75659fb1eaea562c626ff54521f6dfb02da6b3
2021-02-03 16:15:48 +01:00
Orion Hodson
8f75f76fbd Permissions for odrefresh and /data/misc/apexdata/com.android.art
odrefresh is the process responsible for checking and creating ART
compilation artifacts that live in the ART APEX data
directory (/data/misc/apexdata/com.android.art).

There are two types of change here:

1) enabling odrefresh to run dex2oat and write updated boot class path
   and system server AOT artifacts into the ART APEX data directory.

2) enabling the zygote and assorted diagnostic tools to use the
   updated AOT artifacts.

odrefresh uses two file contexts: apex_art_data_file and
apex_art_staging_data_file. When odrefresh invokes dex2oat, the
generated files have the apex_art_staging_data_file label (which allows
writing). odrefresh then moves these files from the staging area to
their installation area and gives them the apex_art_data_file label.

Bug: 160683548
Test: adb root && adb shell /apex/com.android.art/bin/odrefresh
Change-Id: I9fa290e0c9c1b7b82be4dacb9f2f8cb8c11e4895
2021-01-13 10:38:22 +00:00