e72ec6bfd3
Allow the startup domain to pick up integrity-checked artifacts from the dalvik-cache. The corresponding framework code will only load the system server classpath. Bug: 128688902 Test: m Test: manual Merged-In: Ib37f8d7c39431e2792eeb4dac1cd732307519827 Change-Id: Ib37f8d7c39431e2792eeb4dac1cd732307519827
20 lines
830 B
Text
20 lines
830 B
Text
type system_server_startup, domain, coredomain;
|
|
type system_server_startup_tmpfs, file_type;
|
|
|
|
tmpfs_domain(system_server_startup)
|
|
|
|
# Create JIT memory
|
|
allow system_server_startup self:process execmem;
|
|
allow system_server_startup system_server_startup_tmpfs:file { execute read write open map };
|
|
|
|
# Allow to pick up integrity-checked artifacts from the dalvik cache.
|
|
allow system_server_startup dalvikcache_data_file:dir r_dir_perms;
|
|
allow system_server_startup dalvikcache_data_file:file { r_file_perms execute };
|
|
|
|
# While doing the above, will touch the apex mount dir.
|
|
allow system_server_startup mnt_expand_file:dir getattr;
|
|
|
|
# Allow system_server_startup to run setcon() and enter the
|
|
# system_server domain
|
|
allow system_server_startup self:process setcurrent;
|
|
allow system_server_startup system_server:process dyntransition;
|