PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Give map permission to viewcompiler

Browse Source 
On cuttlefish devices, the resource loading code apparently maps the file rather
than just reading it.

Denial log:

viewcompiler: type=1400 audit(0.0:308): avc: denied { map } for
path="/data/app/android.startop.test-Z2JxVhtKPw2wx4o-nmo5NA==/base.apk"
dev="vdb" ino=139269 scontext=u:r:viewcompiler:s0
tcontext=u:object_r:apk_data_file:s0 tclass=file permissive=0
app=android.startop.test

Bug: 139018973
Change-Id: I4bbbc44abc3c4315137f76a0be737236cf10f4ef
This commit is contained in:
Eric Holk 2019-08-15 15:15:30 -07:00
parent 4d40aefa4b
commit 04ee9fb1b2
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
private/viewcompiler.te
View File

@ -17,7 +17,7 @@ allow viewcompiler installd:fd use;
allow viewcompiler app_data_file:file { getattr write };
# Allow the view compiler to read resources from the apps APK.
allow viewcompiler apk_data_file:file read;
allow viewcompiler apk_data_file:file { read map };
# priv-apps are moving to a world where they can only execute
# signed code. Make sure viewcompiler never can write to privapp