5a74473d1b
This is a partial revert of https://android-review.googlesource.com/c/platform/system/sepolicy/+/891474 The mount points at /bionic are gone. Therefore, init and otapreopt_chroot do not need to bionic-mount bionic libraries. Corresponding policies are removed. Bug: 125549215 Bug: 113373927 Bug: 120266448 Test: m; device boots Change-Id: I9d9d7ec204315fb5b66beec4e6a3c529bd827590
38 lines
1.5 KiB
Plaintext
38 lines
1.5 KiB
Plaintext
typeattribute otapreopt_chroot coredomain;
|
|
|
|
# Allow to transition to postinstall_dexopt, to run otapreopt in its own sandbox.
|
|
domain_auto_trans(otapreopt_chroot, postinstall_file, postinstall_dexopt)
|
|
|
|
# Allow otapreopt_chroot to create loop devices with /dev/loop-control.
|
|
allow otapreopt_chroot loop_control_device:chr_file rw_file_perms;
|
|
# Allow otapreopt_chroot to access loop devices.
|
|
allow otapreopt_chroot loop_device:blk_file rw_file_perms;
|
|
allowxperm otapreopt_chroot loop_device:blk_file ioctl {
|
|
LOOP_GET_STATUS64
|
|
LOOP_SET_STATUS64
|
|
LOOP_SET_FD
|
|
LOOP_SET_BLOCK_SIZE
|
|
LOOP_SET_DIRECT_IO
|
|
LOOP_CLR_FD
|
|
BLKFLSBUF
|
|
};
|
|
|
|
# Allow otapreopt_chroot to configure read-ahead of loop devices.
|
|
allow otapreopt_chroot sysfs_loop:dir r_dir_perms;
|
|
allow otapreopt_chroot sysfs_loop:file rw_file_perms;
|
|
|
|
# Allow otapreopt_chroot to mount a tmpfs filesystem in /postinstall/apex.
|
|
allow otapreopt_chroot tmpfs:filesystem mount;
|
|
# Allow otapreopt_chroot to restore the security context of /postinstall/apex.
|
|
allow otapreopt_chroot tmpfs:dir relabelfrom;
|
|
allow otapreopt_chroot postinstall_apex_mnt_dir:dir relabelto;
|
|
|
|
# Allow otapreopt_chroot to manipulate directory /postinstall/apex.
|
|
allow otapreopt_chroot postinstall_apex_mnt_dir:dir create_dir_perms;
|
|
# Allow otapreopt_chroot to mount APEX packages in /postinstall/apex.
|
|
allow otapreopt_chroot postinstall_apex_mnt_dir:dir mounton;
|
|
|
|
# Allow otapreopt_chroot to access /dev/block (needed to detach loop
|
|
# devices used by ext4 images from APEX packages).
|
|
allow otapreopt_chroot block_device:dir r_dir_perms;
|