private/derive_classpath.te

# Domain for derive_classpath
type derive_classpath, domain, coredomain, artd_subprocess_type;
type derive_classpath_exec, system_file_type, exec_type, file_type;
init_daemon_domain(derive_classpath)

# Read /apex
allow derive_classpath apex_mnt_dir:dir r_dir_perms;
allow derive_classpath vendor_apex_metadata_file:dir r_dir_perms;

# Create /data/system/environ/classpath file
allow derive_classpath environ_system_data_file:dir rw_dir_perms;
allow derive_classpath environ_system_data_file:file create_file_perms;

# b/183079517 fails on gphone targets otherwise
allow derive_classpath unlabeled:dir search;

# Allow to be called by artd in Pre-reboot Dexopt.
allow derive_classpath artd:fd use;

# Allow writing to Pre-reboot Dexopt temp files.
allow derive_classpath pre_reboot_dexopt_artd_file:file { open read write };