platform_system_sepolicy/private/composd.te
Alan Stokes 8788f7afe2 Split composd's service in two
They are served by the same process but have different clients:
- the main interface is exposed to system server;
- the internal interface is called by odrefresh when spawned by composd.

Test: compos_cmd forced-compile-test
Bug: 199147668
Change-Id: Ie1561b7700cf633d7d5c8df68ff58797a8d8bced
2021-11-22 09:36:45 +00:00

24 lines
798 B
Text

type composd, domain, coredomain;
type composd_exec, system_file_type, exec_type, file_type;
# Host dynamic AIDL services
init_daemon_domain(composd)
binder_use(composd)
add_service(composd, compos_service)
add_service(composd, compos_internal_service)
# Call back into system server
binder_call(composd, system_server)
# Start a VM
virtualizationservice_use(composd)
# Access our APEX data files
allow composd apex_module_data_file:dir search;
allow composd apex_compos_data_file:dir create_dir_perms;
allow composd apex_compos_data_file:file create_file_perms;
# TODO(b/205750213): Removed these when we run odrefresh in the VM
# Run odrefresh to refresh ART artifacts, and kill it if we need to
domain_auto_trans(composd, odrefresh_exec, odrefresh)
allow composd odrefresh:process sigkill;