8f75f76fbd
odrefresh is the process responsible for checking and creating ART compilation artifacts that live in the ART APEX data directory (/data/misc/apexdata/com.android.art). There are two types of change here: 1) enabling odrefresh to run dex2oat and write updated boot class path and system server AOT artifacts into the ART APEX data directory. 2) enabling the zygote and assorted diagnostic tools to use the updated AOT artifacts. odrefresh uses two file contexts: apex_art_data_file and apex_art_staging_data_file. When odrefresh invokes dex2oat, the generated files have the apex_art_staging_data_file label (which allows writing). odrefresh then moves these files from the staging area to their installation area and gives them the apex_art_data_file label. Bug: 160683548 Test: adb root && adb shell /apex/com.android.art/bin/odrefresh Change-Id: I9fa290e0c9c1b7b82be4dacb9f2f8cb8c11e4895
53 lines
1.1 KiB
Text
53 lines
1.1 KiB
Text
typeattribute crash_dump coredomain;
|
|
|
|
# Crash dump does not need to access devices passed across exec().
|
|
dontaudit crash_dump { devpts dev_type }:chr_file { read write };
|
|
|
|
allow crash_dump {
|
|
domain
|
|
-apexd
|
|
-bpfloader
|
|
-crash_dump
|
|
-init
|
|
-kernel
|
|
-keystore
|
|
-llkd
|
|
-logd
|
|
-ueventd
|
|
-vendor_init
|
|
-vold
|
|
}:process { ptrace signal sigchld sigstop sigkill };
|
|
userdebug_or_eng(`
|
|
allow crash_dump { apexd llkd logd vold }:process { ptrace signal sigchld sigstop sigkill };
|
|
')
|
|
|
|
###
|
|
### neverallow assertions
|
|
###
|
|
|
|
# ptrace neverallow assertions are spread throughout the other policy
|
|
# files, so we avoid adding redundant assertions here
|
|
|
|
neverallow crash_dump {
|
|
apexd
|
|
userdebug_or_eng(`-apexd')
|
|
bpfloader
|
|
init
|
|
kernel
|
|
keystore
|
|
llkd
|
|
userdebug_or_eng(`-llkd')
|
|
logd
|
|
userdebug_or_eng(`-logd')
|
|
ueventd
|
|
vendor_init
|
|
vold
|
|
userdebug_or_eng(`-vold')
|
|
}:process { signal sigstop sigkill };
|
|
|
|
neverallow crash_dump self:process ptrace;
|
|
neverallow crash_dump gpu_device:chr_file *;
|
|
|
|
# Read ART APEX data directory
|
|
allow crash_dump apex_art_data_file:dir { getattr search };
|
|
allow crash_dump apex_art_data_file:file r_file_perms;
|