2015-06-19 10:47:26 -07:00
|
|
|
# idmap, when executed by installd
|
2016-12-09 19:30:39 -08:00
|
|
|
type idmap, domain;
|
2018-09-27 10:21:37 -07:00
|
|
|
type idmap_exec, system_file_type, exec_type, file_type;
|
2015-06-19 10:47:26 -07:00
|
|
|
|
2019-04-15 16:10:02 -07:00
|
|
|
# TODO remove /system/bin/idmap and the link between idmap and installd (b/118711077)
|
2015-06-19 10:47:26 -07:00
|
|
|
# Use open file to /data/resource-cache file inherited from installd.
|
|
|
|
allow idmap installd:fd use;
|
2018-06-14 23:08:19 -07:00
|
|
|
allow idmap resourcecache_data_file:file create_file_perms;
|
|
|
|
allow idmap resourcecache_data_file:dir rw_dir_perms;
|
2015-06-19 10:47:26 -07:00
|
|
|
|
2018-01-24 13:56:28 -08:00
|
|
|
# Ignore reading /proc/<pid>/maps after a fork.
|
|
|
|
dontaudit idmap installd:file read;
|
|
|
|
|
2015-06-19 10:47:26 -07:00
|
|
|
# Open and read from target and overlay apk files passed by argument.
|
|
|
|
allow idmap apk_data_file:file r_file_perms;
|
2015-06-22 00:31:25 -07:00
|
|
|
allow idmap apk_data_file:dir search;
|
2017-04-04 09:30:41 -07:00
|
|
|
|
2019-04-15 16:10:02 -07:00
|
|
|
# Allow /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
|
|
|
|
allow idmap { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
|
|
|
|
allow idmap { apk_tmp_file apk_private_tmp_file }:dir search;
|
|
|
|
|
2017-04-04 09:30:41 -07:00
|
|
|
# Allow apps access to /vendor/app
|
|
|
|
r_dir_file(idmap, vendor_app_file)
|
2017-04-05 16:16:13 -07:00
|
|
|
|
|
|
|
# Allow apps access to /vendor/overlay
|
|
|
|
r_dir_file(idmap, vendor_overlay_file)
|
2018-06-14 23:08:19 -07:00
|
|
|
|
|
|
|
# Allow the idmap2d binary to register as a service and communicate via AIDL
|
|
|
|
binder_use(idmap)
|
2019-09-18 04:45:15 -07:00
|
|
|
binder_service(idmap)
|
2018-06-14 23:08:19 -07:00
|
|
|
add_service(idmap, idmap_service)
|