0a6c2d013a
Allow `otapreopt_chroot` to: - read SELinux policy files; - open and read the contents of `/postinstall/system/apex`; - read the `persist.apexd.verity_on_system` system property; - create loop devices with `/dev/loop-control`; - access loop devices; - configure read-ahead of loop devices; - mount a tmpfs filesystem in `/postinstall/apex`; - manipulate the tmpfs filesystem mounted in `/postinstall/apex`; - mount APEX packages in `/postinstall/apex`. Allow the kernel to: - read `otapreopt_chroot`'s file descriptors; - read files under `/postinstall`. Allow `otapreopt` (running as "postinstall_dexopt") to: - read data from `/postinstall/apex`. Allow `dex2oat` to: - access `/postinstall/apex`. Test: A/B OTA update test (asit/dexoptota/self_full). Bug: 113373927 Bug: 120796514 Change-Id: I204df92611dc710fdc97b22cd67d088ffd991210
60 lines
2.6 KiB
Text
60 lines
2.6 KiB
Text
# Domain for the otapreopt executable, running under postinstall_dexopt
|
|
#
|
|
# Note: otapreopt is a driver for dex2oat, and reuses parts of installd. As such,
|
|
# this is derived and adapted from installd.te.
|
|
|
|
type postinstall_dexopt, domain;
|
|
|
|
allow postinstall_dexopt self:global_capability_class_set { chown dac_override dac_read_search fowner fsetid setgid setuid };
|
|
|
|
allow postinstall_dexopt postinstall_file:filesystem getattr;
|
|
allow postinstall_dexopt postinstall_file:dir { getattr search };
|
|
allow postinstall_dexopt postinstall_file:lnk_file { getattr read };
|
|
allow postinstall_dexopt proc_filesystems:file { getattr open read };
|
|
allow postinstall_dexopt tmpfs:file read;
|
|
|
|
# Read data from /postinstall/apex.
|
|
allow postinstall_dexopt tmpfs:dir { read search };
|
|
|
|
# Note: /data/ota is created by init (see system/core/rootdir/init.rc) to avoid giving access
|
|
# here and having to relabel the directory.
|
|
|
|
# Read app data (APKs) as input to dex2oat.
|
|
r_dir_file(postinstall_dexopt, apk_data_file)
|
|
# Read vendor app data (APKs) as input to dex2oat.
|
|
r_dir_file(postinstall_dexopt, vendor_app_file)
|
|
# Access to app oat directory.
|
|
r_dir_file(postinstall_dexopt, dalvikcache_data_file)
|
|
|
|
# Read profile data.
|
|
allow postinstall_dexopt user_profile_data_file:dir { getattr search };
|
|
allow postinstall_dexopt user_profile_data_file:file r_file_perms;
|
|
# Suppress deletion denial (we do not want to update the profile).
|
|
dontaudit postinstall_dexopt user_profile_data_file:file { write };
|
|
|
|
# Write to /data/ota(/*). Create symlinks in /data/ota(/*)
|
|
allow postinstall_dexopt ota_data_file:dir create_dir_perms;
|
|
allow postinstall_dexopt ota_data_file:file create_file_perms;
|
|
allow postinstall_dexopt ota_data_file:lnk_file create_file_perms;
|
|
|
|
# Need to write .b files, which are dalvikcache_data_file, not ota_data_file.
|
|
# TODO: See whether we can apply ota_data_file?
|
|
allow postinstall_dexopt dalvikcache_data_file:dir rw_dir_perms;
|
|
allow postinstall_dexopt dalvikcache_data_file:file create_file_perms;
|
|
|
|
# Allow labeling of files under /data/app/com.example/oat/
|
|
# TODO: Restrict to .b suffix?
|
|
allow postinstall_dexopt dalvikcache_data_file:dir relabelto;
|
|
allow postinstall_dexopt dalvikcache_data_file:file { relabelto link };
|
|
|
|
# Check validity of SELinux context before use.
|
|
selinux_check_context(postinstall_dexopt)
|
|
selinux_check_access(postinstall_dexopt)
|
|
|
|
|
|
# Postinstall wants to know about our child.
|
|
allow postinstall_dexopt postinstall:process sigchld;
|
|
|
|
# Allow otapreopt to use file descriptors from otapreopt_chroot.
|
|
# TODO: Probably we can actually close file descriptors...
|
|
allow postinstall_dexopt otapreopt_chroot:fd use;
|