b335e3847f
Run idmap in its own domain rather than leaving it in installd's domain. This prevents misuse of installd's permissions by idmap. zygote also needs to run idmap. For now, just run it in zygote's domain as it was previously since that is what is done for dex2oat invocation by zygote. zygote appears to run idmap with system uid while installd runs it with app UIDs, so using different domains seems appropriate. Remove system_file execute_no_trans from both installd and zygote; this should no longer be needed with explicit labels for dex2oat and idmap. Change-Id: If47e2c1326b84c20e94a20f5e699300dce12bdfe Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
10 lines
375 B
Text
10 lines
375 B
Text
# idmap, when executed by installd
|
|
type idmap, domain;
|
|
type idmap_exec, exec_type, file_type;
|
|
|
|
# Use open file to /data/resource-cache file inherited from installd.
|
|
allow idmap installd:fd use;
|
|
allow idmap resourcecache_data_file:file { getattr read write };
|
|
|
|
# Open and read from target and overlay apk files passed by argument.
|
|
allow idmap apk_data_file:file r_file_perms;
|