caf42d615d
Create a transient SELinux domain where system_server can perform certain JIT setup. The idea is that system_server will start in the system_server_startup domain, setup certain JIT pages, then perform a one-way transition into the system_server domain. From that point, further JITing operations are disallowed. Bug: 62356545 Test: device boots, no permission errors Change-Id: Ic55b2cc5aba420ebcf62736622e08881a4779004
12 lines
452 B
Text
12 lines
452 B
Text
type system_server_startup, domain, coredomain;
|
|
|
|
tmpfs_domain(system_server_startup)
|
|
|
|
# Create JIT memory
|
|
allow system_server_startup self:process execmem;
|
|
allow system_server_startup system_server_startup_tmpfs:file { execute read write open map };
|
|
|
|
# Allow system_server_startup to run setcon() and enter the
|
|
# system_server domain
|
|
allow system_server_startup self:process setcurrent;
|
|
allow system_server_startup system_server:process dyntransition;
|