platform_system_sepolicy/private/postinstall_dexopt.te at 87988fa6a6c925db44ac5963fb5220f34401342e - tequilaOS/platform_system_sepolicy - gitownia.eu

tequilaOS/platform_system_sepolicy

Roland Levillain ab9c053078 Allow oatpreopt to run dex2oat from the Runtime APEX.

- Allow `postinstall_dexopt` to transition to domain `dex2oat` when
  executing `dex2oat` from the Runtime APEX
  (`/postinstall/apex/com.android.com/bin/dex2oat`).
- Allow `dex2oat` (from the Runtime APEX) to read files under
  `/postinstall` (e.g. APKs under `/system`, `/system/bin/linker`);

- Also allow `dex2oat` (from the Runtime APEX) to use libraries under
  `/postinstall/system` (e.g. `/system/lib/libc.so`). This is
  temporary change until Bionic libraries are part of the Runtime
  APEX.

Test: A/B OTA update test (asit/dexoptota/self_full).
Bug: 113373927
Bug: 120796514
Change-Id: I0a8a6ac485f725753ee909b1561becd3bd908ce4

2019-01-23 16:18:35 +00:00

5 lines

216 B

Text

Raw Blame History

 typeattribute postinstall_dexopt coredomain;
 # Run dex2oat/patchoat in its own sandbox.
 # We have to manually transition, as we don't have an entrypoint.
 domain_auto_trans(postinstall_dexopt, dex2oat_exec, dex2oat)