e16fb9109c
This is being done in preparation for the migration from ashmem to memfd. In order for tmpfs objects to be usable across the Treble boundary, they need to be declared in public policy whereas, they're currently all declared in private policy as part of the tmpfs_domain() macro. Remove the type declaration from the macro, and remove tmpfs_domain() from the init_daemon_domain() macro to avoid having to declare the *_tmpfs types for all init launched domains. tmpfs is mostly used by apps and the media frameworks. Bug: 122854450 Test: Boot Taimen and blueline. Watch videos, make phone calls, browse internet, send text, install angry birds...play angry birds, keep playing angry birds... Change-Id: I20a47d2bb22e61b16187015c7bc7ca10accf6358
31 lines
1.5 KiB
Text
31 lines
1.5 KiB
Text
# dexoptanalyzer
|
|
type dexoptanalyzer, domain, coredomain, mlstrustedsubject;
|
|
type dexoptanalyzer_exec, system_file_type, exec_type, file_type;
|
|
type dexoptanalyzer_tmpfs, file_type;
|
|
|
|
# Reading an APK opens a ZipArchive, which unpack to tmpfs.
|
|
# Use tmpfs_domain() which will give tmpfs files created by dexoptanalyzer their
|
|
# own label, which differs from other labels created by other processes.
|
|
# This allows to distinguish in policy files created by dexoptanalyzer vs other
|
|
#processes.
|
|
tmpfs_domain(dexoptanalyzer)
|
|
|
|
# Read symlinks in /data/dalvik-cache. This is required for PIC mode boot
|
|
# app_data_file the oat file is symlinked to the original file in /system.
|
|
allow dexoptanalyzer dalvikcache_data_file:dir { getattr search };
|
|
allow dexoptanalyzer dalvikcache_data_file:file r_file_perms;
|
|
allow dexoptanalyzer dalvikcache_data_file:lnk_file read;
|
|
|
|
allow dexoptanalyzer installd:fd use;
|
|
|
|
# Allow reading secondary dex files that were reported by the app to the
|
|
# package manager.
|
|
allow dexoptanalyzer { privapp_data_file app_data_file }:dir { getattr search };
|
|
allow dexoptanalyzer { privapp_data_file app_data_file }:file { getattr read };
|
|
# dexoptanalyzer calls access(2) with W_OK flag on app data. We can use the
|
|
# "dontaudit...audit_access" policy line to suppress the audit access without
|
|
# suppressing denial on actual access.
|
|
dontaudit dexoptanalyzer { privapp_data_file app_data_file }:dir audit_access;
|
|
|
|
# Allow testing /data/user/0 which symlinks to /data/data
|
|
allow dexoptanalyzer system_data_file:lnk_file { getattr };
|