1# otapreopt_chroot executable
2typeattribute otapreopt_chroot coredomain;
3type otapreopt_chroot_exec, exec_type, file_type, system_file_type;
4
5# Chroot preparation and execution.
6# We need to create an unshared mount namespace, and then mount /data.
7allow otapreopt_chroot postinstall_file:dir { search mounton };
8allow otapreopt_chroot apex_mnt_dir:dir mounton;
9allow otapreopt_chroot device:dir mounton;
10allow otapreopt_chroot linkerconfig_file:dir mounton;
11allow otapreopt_chroot rootfs:dir mounton;
12allow otapreopt_chroot sysfs:dir mounton;
13allow otapreopt_chroot system_data_root_file:dir mounton;
14allow otapreopt_chroot system_file:dir mounton;
15allow otapreopt_chroot vendor_file:dir mounton;
16allow otapreopt_chroot self:global_capability_class_set { sys_admin sys_chroot };
17
18# This is required to mount /vendor and mount/unmount ext4 images from
19# APEX packages in /postinstall/apex.
20allow otapreopt_chroot block_device:dir search;
21allow otapreopt_chroot labeledfs:filesystem { mount unmount };
22# This is required for dynamic partitions.
23allow otapreopt_chroot dm_device:chr_file rw_file_perms;
24
25# This is required to unmount flattened APEX packages under
26# /postinstall/system/apex (which are bind-mounted in /postinstall/apex).
27allow otapreopt_chroot postinstall_file:filesystem unmount;
28# Mounting /vendor can have this side-effect. Ignore denial.
29dontaudit otapreopt_chroot kernel:process setsched;
30
31# Allow otapreopt_chroot to read SELinux policy files.
32allow otapreopt_chroot file_contexts_file:file r_file_perms;
33
34# Allow otapreopt_chroot to open and read the contents of /postinstall/system/apex.
35allow otapreopt_chroot postinstall_file:dir r_dir_perms;
36# Allow otapreopt_chroot to read the persist.apexd.verity_on_system system property.
37get_prop(otapreopt_chroot, apexd_prop)
38
39# Allow otapreopt to use file descriptors from update-engine. It will
40# close them immediately.
41allow otapreopt_chroot postinstall:fd use;
42allow otapreopt_chroot update_engine:fd use;
43allow otapreopt_chroot update_engine:fifo_file write;
44
45# Allow to transition to postinstall_dexopt, to run otapreopt in its own sandbox.
46domain_auto_trans(otapreopt_chroot, postinstall_dexopt_exec, postinstall_dexopt)
47domain_auto_trans(otapreopt_chroot, linkerconfig_exec, linkerconfig)
48domain_auto_trans(otapreopt_chroot, apexd_exec, apexd)
49
50# Allow otapreopt_chroot to control linkerconfig
51allow otapreopt_chroot linkerconfig_file:dir { create_dir_perms relabelto };
52allow otapreopt_chroot linkerconfig_file:file create_file_perms;
53
54# Allow otapreopt_chroot to create loop devices with /dev/loop-control.
55allow otapreopt_chroot loop_control_device:chr_file rw_file_perms;
56# Allow otapreopt_chroot to access loop devices.
57allow otapreopt_chroot loop_device:blk_file rw_file_perms;
58allowxperm otapreopt_chroot loop_device:blk_file ioctl {
59  LOOP_CONFIGURE
60  LOOP_GET_STATUS64
61  LOOP_SET_STATUS64
62  LOOP_SET_FD
63  LOOP_SET_BLOCK_SIZE
64  LOOP_SET_DIRECT_IO
65  LOOP_CLR_FD
66  BLKFLSBUF
67};
68
69# Allow otapreopt_chroot to configure read-ahead of loop devices.
70allow otapreopt_chroot sysfs_loop:dir r_dir_perms;
71allow otapreopt_chroot sysfs_loop:file rw_file_perms;
72
73# Allow otapreopt_chroot to mount a tmpfs filesystem in /postinstall/apex.
74allow otapreopt_chroot tmpfs:filesystem mount;
75# Allow otapreopt_chroot to restore the security context of /postinstall/apex.
76allow otapreopt_chroot tmpfs:dir relabelfrom;
77allow otapreopt_chroot postinstall_apex_mnt_dir:dir relabelto;
78
79# Allow otapreopt_chroot to manipulate directory /postinstall/apex.
80allow otapreopt_chroot postinstall_apex_mnt_dir:dir create_dir_perms;
81allow otapreopt_chroot postinstall_apex_mnt_dir:file create_file_perms;
82# Allow otapreopt_chroot to mount APEX packages in /postinstall/apex.
83allow otapreopt_chroot postinstall_apex_mnt_dir:dir mounton;
84
85# Allow otapreopt_chroot to access /dev/block (needed to detach loop
86# devices used by ext4 images from APEX packages).
87allow otapreopt_chroot block_device:dir r_dir_perms;
88
89# Allow to access the linker through the symlink.
90allow otapreopt_chroot postinstall_file:lnk_file r_file_perms;
91
92# Allow otapreopt_chroot to read ro.cold_boot_done prop.
93# This is a temporary solution to make sure that otapreopt_chroot doesn't block indefinetelly.
94# TODO(b/165948777): remove this once otapreopt_chroot is migrated to libapexmount.
95get_prop(otapreopt_chroot, cold_boot_done_prop)
96
97# allow otapreopt_chroot to run the linkerconfig from the new image.
98allow otapreopt_chroot linkerconfig_exec:file rx_file_perms;
99