15e02450f1
The file descriptors for /dev/zero are no longer open. However, a descriptor to the shell is still inherited. Update the comment. Bug: 126787589 Test: m Test: manual Change-Id: I0d4518d2ba771622ea969bbf02827db45788bc09
32 lines
1.2 KiB
Plaintext
32 lines
1.2 KiB
Plaintext
# ART APEX postinstall.
|
|
#
|
|
|
|
type art_apex_postinstall, domain, coredomain;
|
|
type art_apex_postinstall_exec, system_file_type, exec_type, file_type;
|
|
|
|
# /system/bin/sh (see b/126787589).
|
|
allow art_apex_postinstall apexd:fd use;
|
|
|
|
# Read temp dirs and files. Move directories.
|
|
allow art_apex_postinstall ota_data_file:dir { r_dir_perms write rename remove_name relabelfrom reparent };
|
|
allow art_apex_postinstall ota_data_file:file { r_file_perms relabelfrom };
|
|
# We're deleting the old /data/dalvik-cache/* and move the new ones
|
|
# over.
|
|
allow art_apex_postinstall dalvikcache_data_file:dir { create_dir_perms relabelto };
|
|
allow art_apex_postinstall dalvikcache_data_file:file { r_file_perms unlink relabelto };
|
|
|
|
# Required for relabel.
|
|
allow art_apex_postinstall file_contexts_file:file r_file_perms;
|
|
allow art_apex_postinstall self:global_capability_class_set sys_admin;
|
|
|
|
# Script helpers.
|
|
allow art_apex_postinstall shell_exec:file rx_file_perms;
|
|
allow art_apex_postinstall toolbox_exec:file rx_file_perms;
|
|
|
|
# Fsverity in the same domain.
|
|
allow art_apex_postinstall system_file:file execute_no_trans;
|
|
# Fsverity work.
|
|
allowxperm art_apex_postinstall ota_data_file:file ioctl {
|
|
FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY
|
|
};
|