1 # Domain for the otapreopt executable, running under postinstall_dexopt 2 # 3 # Note: otapreopt is a driver for dex2oat, and reuses parts of installd. As such, 4 # this is derived and adapted from installd.te. 5 6 type postinstall_dexopt, domain; 7 8 allow postinstall_dexopt self:global_capability_class_set { chown dac_override fowner fsetid setgid setuid }; 9 10 allow postinstall_dexopt postinstall_file:filesystem getattr; 11 allow postinstall_dexopt postinstall_file:dir { getattr search }; 12 allow postinstall_dexopt postinstall_file:lnk_file { getattr read }; 13 allow postinstall_dexopt proc_filesystems:file { getattr open read }; 14 allow postinstall_dexopt tmpfs:file read; 15 16 # Note: /data/ota is created by init (see system/core/rootdir/init.rc) to avoid giving access 17 # here and having to relabel the directory. 18 19 # Read app data (APKs) as input to dex2oat. 20 r_dir_file(postinstall_dexopt, apk_data_file) 21 # Read vendor app data (APKs) as input to dex2oat. 22 r_dir_file(postinstall_dexopt, vendor_app_file) 23 # Access to app oat directory. 24 r_dir_file(postinstall_dexopt, dalvikcache_data_file) 25 26 # Read profile data. 27 allow postinstall_dexopt user_profile_data_file:dir { getattr search }; 28 allow postinstall_dexopt user_profile_data_file:file r_file_perms; 29 # Suppress deletion denial (we do not want to update the profile). 30 dontaudit postinstall_dexopt user_profile_data_file:file { write }; 31 32 # Write to /data/ota(/*). Create symlinks in /data/ota(/*) 33 allow postinstall_dexopt ota_data_file:dir create_dir_perms; 34 allow postinstall_dexopt ota_data_file:file create_file_perms; 35 allow postinstall_dexopt ota_data_file:lnk_file create_file_perms; 36 37 # Need to write .b files, which are dalvikcache_data_file, not ota_data_file. 38 # TODO: See whether we can apply ota_data_file? 39 allow postinstall_dexopt dalvikcache_data_file:dir rw_dir_perms; 40 allow postinstall_dexopt dalvikcache_data_file:file create_file_perms; 41 42 # Allow labeling of files under /data/app/com.example/oat/ 43 # TODO: Restrict to .b suffix? 44 allow postinstall_dexopt dalvikcache_data_file:dir relabelto; 45 allow postinstall_dexopt dalvikcache_data_file:file { relabelto link }; 46 47 # Check validity of SELinux context before use. 48 selinux_check_context(postinstall_dexopt) 49 selinux_check_access(postinstall_dexopt) 50 51 52 # Postinstall wants to know about our child. 53 allow postinstall_dexopt postinstall:process sigchld; 54 55 # Allow otapreopt to use file descriptors from otapreopt_chroot. 56 # TODO: Probably we can actually close file descriptors... 57 allow postinstall_dexopt otapreopt_chroot:fd use; 58 59 allow postinstall_dexopt cpuctl_device:dir search; 60
