8b65b0b12d
ro.apk_verity.mode was introduced in P on crosshatch. This change changes the label from default_prop to a new property, apk_verity_prop. ro.apk_verity.mode is set by vendor_init per build.prop, in order to honor Treble split. It is also read by system_server and installd currently. Test: verify functioning without denials in dmesg Bug: 142494008 Bug: 144164497 Change-Id: I1f24513d79237091cf30025bb7ca63282e23c739
46 lines
1.5 KiB
Plaintext
46 lines
1.5 KiB
Plaintext
typeattribute installd coredomain;
|
|
|
|
init_daemon_domain(installd)
|
|
|
|
# Run migrate_legacy_obb_data.sh in its own sandbox.
|
|
domain_auto_trans(installd, migrate_legacy_obb_data_exec, migrate_legacy_obb_data)
|
|
allow installd shell_exec:file rx_file_perms;
|
|
|
|
# Run dex2oat in its own sandbox.
|
|
domain_auto_trans(installd, dex2oat_exec, dex2oat)
|
|
|
|
# Run dexoptanalyzer in its own sandbox.
|
|
domain_auto_trans(installd, dexoptanalyzer_exec, dexoptanalyzer)
|
|
|
|
# Run viewcompiler in its own sandbox.
|
|
domain_auto_trans(installd, viewcompiler_exec, viewcompiler)
|
|
|
|
# Run profman in its own sandbox.
|
|
domain_auto_trans(installd, profman_exec, profman)
|
|
|
|
# Run idmap in its own sandbox.
|
|
domain_auto_trans(installd, idmap_exec, idmap)
|
|
|
|
# For collecting bugreports.
|
|
allow installd dumpstate:fd use;
|
|
allow installd dumpstate:fifo_file r_file_perms;
|
|
|
|
# Delete /system/bin/bcc generated artifacts
|
|
allow installd app_exec_data_file:file unlink;
|
|
|
|
# Capture userdata snapshots to /data/misc_[ce|de]/rollback and
|
|
# subsequently restore them.
|
|
allow installd rollback_data_file:dir create_dir_perms;
|
|
allow installd rollback_data_file:file create_file_perms;
|
|
|
|
# Allow installd to access the runtime feature flag properties.
|
|
get_prop(installd, device_config_runtime_native_prop)
|
|
get_prop(installd, device_config_runtime_native_boot_prop)
|
|
|
|
# Allow installd to access apk verity feature flag (for legacy case).
|
|
get_prop(installd, apk_verity_prop)
|
|
|
|
# Allow installd to delete files in /data/staging
|
|
allow installd staging_data_file:file unlink;
|
|
allow installd staging_data_file:dir { open read remove_name rmdir search write };
|