Home | History | Annotate | Download | only in sepolicy 
      1 # Domain for the otapreopt executable, running under postinstall_dexopt
      2 #
      3 # Note: otapreopt is a driver for dex2oat, and reuses parts of installd. As such,
      4 # this is derived and adapted from installd.te.
      5 
      6 type postinstall_dexopt, domain;
      7 
      8 # init_daemon_domain(otapreopt)
      9 allow postinstall_dexopt self:capability { chown dac_override fowner setgid setuid };
     10 
     11 allow postinstall_dexopt postinstall_file:dir { getattr search };
     12 allow postinstall_dexopt proc:file { getattr open read };
     13 allow postinstall_dexopt tmpfs:file read;
     14 
     15 # Note: /data/ota is created by init (see system/core/rootdir/init.rc) to avoid giving access
     16 # here and having to relabel the directory.
     17 
     18 # Read app data (APKs) as input to dex2oat.
     19 r_dir_file(postinstall_dexopt, apk_data_file)
     20 # Access to app oat directory.
     21 r_dir_file(postinstall_dexopt, dalvikcache_data_file)
     22 
     23 # Read profile data.
     24 allow postinstall_dexopt user_profile_data_file:dir { getattr search };
     25 allow postinstall_dexopt user_profile_data_file:file r_file_perms;
     26 
     27 # Write to /data/ota(/*). Create symlinks in /data/ota(/*)
     28 allow postinstall_dexopt ota_data_file:dir create_dir_perms;
     29 allow postinstall_dexopt ota_data_file:file create_file_perms;
     30 allow postinstall_dexopt ota_data_file:lnk_file create_file_perms;
     31 
     32 # Need to write .b files, which are dalvikcache_data_file, not ota_data_file.
     33 # TODO: See whether we can apply ota_data_file?
     34 allow postinstall_dexopt dalvikcache_data_file:dir rw_dir_perms;
     35 allow postinstall_dexopt dalvikcache_data_file:file create_file_perms;
     36 
     37 # Allow labeling of files under /data/app/com.example/oat/
     38 # TODO: Restrict to .b suffix?
     39 allow postinstall_dexopt dalvikcache_data_file:dir relabelto;
     40 allow postinstall_dexopt dalvikcache_data_file:file { relabelto link };
     41 
     42 allow postinstall_dexopt selinuxfs:dir r_dir_perms;
     43 
     44 # Check validity of SELinux context before use.
     45 selinux_check_context(postinstall_dexopt)
     46 selinux_check_access(postinstall_dexopt)
     47 
     48 # Run dex2oat/patchoat in its own sandbox.
     49 # We have to manually transition, as we don't have an entrypoint.
     50 domain_auto_trans(postinstall_dexopt, postinstall_file, dex2oat)
     51 
     52 # Postinstall wants to know about our child.
     53 allow postinstall_dexopt postinstall:process sigchld;
     54 
     55 # Allow otapreopt to use file descriptors from otapreopt_chroot.
     56 # TODO: Probably we can actually close file descriptors...
     57 allow postinstall_dexopt otapreopt_chroot:fd use;
     58 
     59 allow postinstall_dexopt cpuctl_device:dir search;
     60