e5a1f64a2e
This CLs adds SElinux policies necessary to compile secondary dex files.
When an app loads secondary dex files via the base class loader the
files will get reported to PM. During maintance mode PM will compile the
secondary dex files which were used via the standard installd model
(fork, exec, change uid and lower capabilities).
What is needed:
dexoptanalyzer - needs to read the dex file and the boot image in order
to decide if we need to actually comppile.
dex2oat - needs to be able to create *.oat files next to the secondary
dex files.
Test: devices boots
compilation of secondary dex files works without selinux denials
cmd package compile --secondary-dex -f -m speed
com.google.android.gms
Bug: 32871170
Change-Id: I038955b5bc9a72d49f6c24c1cb76276e0f53dc45
26 lines
1.1 KiB
Text
26 lines
1.1 KiB
Text
# dexoptanalyzer
|
|
type dexoptanalyzer, domain, mlstrustedsubject;
|
|
type dexoptanalyzer_exec, exec_type, file_type;
|
|
|
|
# Reading an APK opens a ZipArchive, which unpack to tmpfs.
|
|
# Use tmpfs_domain() which will give tmpfs files created by dexoptanalyzer their
|
|
# own label, which differs from other labels created by other processes.
|
|
# This allows to distinguish in policy files created by dexoptanalyzer vs other
|
|
#processes.
|
|
tmpfs_domain(dexoptanalyzer)
|
|
|
|
# Read symlinks in /data/dalvik-cache. This is required for PIC mode boot
|
|
# app_data_file the oat file is symlinked to the original file in /system.
|
|
allow dexoptanalyzer dalvikcache_data_file:dir { getattr search };
|
|
allow dexoptanalyzer dalvikcache_data_file:file r_file_perms;
|
|
allow dexoptanalyzer dalvikcache_data_file:lnk_file read;
|
|
|
|
allow dexoptanalyzer installd:fd use;
|
|
|
|
# Allow reading secondary dex files that were reported by the app to the
|
|
# package manager.
|
|
allow dexoptanalyzer app_data_file:dir { getattr search };
|
|
allow dexoptanalyzer app_data_file:file r_file_perms;
|
|
|
|
# Allow testing /data/user/0 which symlinks to /data/data
|
|
allow dexoptanalyzer system_data_file:lnk_file { getattr };
|