1# dexoptanalyzer
2type dexoptanalyzer, domain, coredomain, mlstrustedsubject;
3type dexoptanalyzer_exec, system_file_type, exec_type, file_type;
4type dexoptanalyzer_tmpfs, file_type;
5
6r_dir_file(dexoptanalyzer, apk_data_file)
7# Access to /vendor/app
8r_dir_file(dexoptanalyzer, vendor_app_file)
9
10# Reading an APK opens a ZipArchive, which unpack to tmpfs.
11# Use tmpfs_domain() which will give tmpfs files created by dexoptanalyzer their
12# own label, which differs from other labels created by other processes.
13# This allows to distinguish in policy files created by dexoptanalyzer vs other
14# processes.
15tmpfs_domain(dexoptanalyzer)
16
17userfaultfd_use(dexoptanalyzer)
18
19# Allow dexoptanalyzer to read files in the dalvik cache.
20allow dexoptanalyzer dalvikcache_data_file:dir { getattr search };
21allow dexoptanalyzer dalvikcache_data_file:file r_file_perms;
22
23# Read symlinks in /data/dalvik-cache. This is required for PIC mode boot
24# app_data_file the oat file is symlinked to the original file in /system.
25allow dexoptanalyzer dalvikcache_data_file:lnk_file read;
26
27# Allow dexoptanalyzer to read files in the ART APEX data directory.
28allow dexoptanalyzer { apex_art_data_file apex_module_data_file }:dir { getattr search };
29allow dexoptanalyzer apex_art_data_file:file r_file_perms;
30
31# Allow dexoptanalyzer to use file descriptors from odrefresh.
32allow dexoptanalyzer odrefresh:fd use;
33
34# Use devpts and fd from odsign (which exec()'s odrefresh)
35allow dexoptanalyzer odsign:fd use;
36allow dexoptanalyzer odsign_devpts:chr_file { read write };
37
38allow dexoptanalyzer installd:fd use;
39allow dexoptanalyzer installd:fifo_file { getattr write };
40
41# Acquire advisory lock on /system/framework/arm/*
42allow dexoptanalyzer system_file:file lock;
43
44# Allow reading secondary dex files that were reported by the app to the
45# package manager.
46allow dexoptanalyzer { privapp_data_file app_data_file }:file { getattr read map };
47
48# Allow testing /data/user/0 which symlinks to /data/data
49allow dexoptanalyzer system_data_file:lnk_file { getattr };
50
51# Allow query ART device config properties
52get_prop(dexoptanalyzer, device_config_runtime_native_prop)
53get_prop(dexoptanalyzer, device_config_runtime_native_boot_prop)
54
55# Allow dexoptanalyzer to read /apex/apex-info-list.xml
56allow dexoptanalyzer apex_info_file:file r_file_perms;
57