1# Domain for the otapreopt executable, running under postinstall_dexopt
2#
3# Note: otapreopt is a driver for dex2oat, and reuses parts of installd. As such,
4# this is derived and adapted from installd.te.
5
6type postinstall_dexopt, domain;
7
8allow postinstall_dexopt self:global_capability_class_set { chown dac_override fowner fsetid setgid setuid };
9
10allow postinstall_dexopt postinstall_file:filesystem getattr;
11allow postinstall_dexopt postinstall_file:dir { getattr search };
12allow postinstall_dexopt postinstall_file:lnk_file { getattr read };
13allow postinstall_dexopt proc_filesystems:file { getattr open read };
14allow postinstall_dexopt tmpfs:file read;
15
16# Note: /data/ota is created by init (see system/core/rootdir/init.rc) to avoid giving access
17# here and having to relabel the directory.
18
19# Read app data (APKs) as input to dex2oat.
20r_dir_file(postinstall_dexopt, apk_data_file)
21# Read vendor app data (APKs) as input to dex2oat.
22r_dir_file(postinstall_dexopt, vendor_app_file)
23# Access to app oat directory.
24r_dir_file(postinstall_dexopt, dalvikcache_data_file)
25
26# Read profile data.
27allow postinstall_dexopt user_profile_data_file:dir { getattr search };
28allow postinstall_dexopt user_profile_data_file:file r_file_perms;
29# Suppress deletion denial (we do not want to update the profile).
30dontaudit postinstall_dexopt user_profile_data_file:file { write };
31
32# Write to /data/ota(/*). Create symlinks in /data/ota(/*)
33allow postinstall_dexopt ota_data_file:dir create_dir_perms;
34allow postinstall_dexopt ota_data_file:file create_file_perms;
35allow postinstall_dexopt ota_data_file:lnk_file create_file_perms;
36
37# Need to write .b files, which are dalvikcache_data_file, not ota_data_file.
38# TODO: See whether we can apply ota_data_file?
39allow postinstall_dexopt dalvikcache_data_file:dir rw_dir_perms;
40allow postinstall_dexopt dalvikcache_data_file:file create_file_perms;
41
42# Allow labeling of files under /data/app/com.example/oat/
43# TODO: Restrict to .b suffix?
44allow postinstall_dexopt dalvikcache_data_file:dir relabelto;
45allow postinstall_dexopt dalvikcache_data_file:file { relabelto link };
46
47# Check validity of SELinux context before use.
48selinux_check_context(postinstall_dexopt)
49selinux_check_access(postinstall_dexopt)
50
51
52# Postinstall wants to know about our child.
53allow postinstall_dexopt postinstall:process sigchld;
54
55# Allow otapreopt to use file descriptors from otapreopt_chroot.
56# TODO: Probably we can actually close file descriptors...
57allow postinstall_dexopt otapreopt_chroot:fd use;
58
59allow postinstall_dexopt cpuctl_device:dir search;
60