17 lines
622 B
Text
17 lines
622 B
Text
typeattribute profman coredomain;
|
|
|
|
# Allow profman to read APKs and profile files next to them by FDs passed from
|
|
# other programs. In addition, allow profman to acquire flocks on those files.
|
|
allow profman {
|
|
system_file
|
|
apk_data_file
|
|
vendor_app_file
|
|
}:file { getattr read map lock };
|
|
|
|
# Allow profman to use file descriptors passed from privileged programs.
|
|
allow profman { artd installd }:fd use;
|
|
|
|
# Allow profman to read from memfd created by artd.
|
|
# profman needs to read the embedded profile that artd extracts from an APK,
|
|
# which is passed by a memfd.
|
|
allow profman artd_tmpfs:file { getattr read map lock };
|