ac097ac4c7
apexd is a new daemon for managing APEX packages installed
on the device. It hosts a single binder service, "apexservice".
Bug: 112455435
Test: builds, binder service can be registered,
apexes can be accessed, verified and mounted
Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
42 lines
1.5 KiB
Text
42 lines
1.5 KiB
Text
typeattribute apexd coredomain;
|
|
|
|
init_daemon_domain(apexd)
|
|
|
|
# Read /system/etc/security/apex_debug_key
|
|
allow apexd apex_key_file:dir search;
|
|
allow apexd apex_key_file:file r_file_perms;
|
|
|
|
# Allow reading and writing of APEX files in the APEX data dir
|
|
allow apexd apex_data_file:dir rw_dir_perms;
|
|
allow apexd apex_data_file:file rw_file_perms;
|
|
|
|
# allow apexd to create loop devices with /dev/loop-control
|
|
allow apexd loop_control_device:chr_file rw_file_perms;
|
|
# allow apexd to access loop devices
|
|
allow apexd loop_device:blk_file rw_file_perms;
|
|
# allow apexd to access /dev/block
|
|
allow apexd block_device:dir r_dir_perms;
|
|
|
|
# allow apexd to access /dev/block/dm-* (device-mapper entries)
|
|
allow apexd dm_device:chr_file rw_file_perms;
|
|
allow apexd dm_device:blk_file rw_file_perms;
|
|
|
|
# sys_admin is required to access the device-mapper and mount
|
|
allow apexd self:global_capability_class_set sys_admin;
|
|
|
|
# allow apexd to create a mount point in /apex
|
|
allow apexd apex_mnt_dir:dir create_dir_perms;
|
|
# allow apexd to mount in /apex
|
|
allow apexd apex_mnt_dir:filesystem { mount unmount };
|
|
allow apexd apex_mnt_dir:dir mounton;
|
|
# Unmount and mount filesystems
|
|
allow apexd labeledfs:filesystem { mount unmount };
|
|
|
|
# Spawning a libbinder thread results in a dac_override deny,
|
|
# /dev/cpuset/tasks is owned by system.
|
|
#
|
|
# See b/35323867#comment3
|
|
dontaudit apexd self:global_capability_class_set { dac_override dac_read_search };
|
|
|
|
neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms;
|
|
neverallow { domain -apexd -init } apex_data_file:file no_rw_file_perms;
|