| # odrefresh |
| type odrefresh, domain, coredomain; |
| type odrefresh_exec, system_file_type, exec_type, file_type; |
| |
| # Allow odrefresh to create files and directories for on device signing. |
| allow odrefresh apex_module_data_file:dir { getattr search }; |
| allow odrefresh apex_art_data_file:dir { create_dir_perms relabelfrom }; |
| allow odrefresh apex_art_data_file:file { open create write read getattr unlink }; |
| |
| # Staging area labels (/data/misc/apexdata/com.android.art/staging). odrefresh |
| # sets up files here and passes file descriptors for dex2oat to write to. |
| allow odrefresh apex_art_staging_data_file:dir { create_dir_perms relabelto }; |
| allow odrefresh apex_art_staging_data_file:file create_file_perms; |
| |
| # Run dex2oat in its own sandbox. |
| domain_auto_trans(odrefresh, dex2oat_exec, dex2oat) |
| |
| # Run dexoptanalyzer in its own sandbox. |
| domain_auto_trans(odrefresh, dexoptanalyzer_exec, dexoptanalyzer) |
| |
| # Do not audit unused resources from parent processes (adb, shell, su). |
| # These appear to be unnecessary for odrefresh. |
| dontaudit odrefresh { adbd shell }:fd use; |
| dontaudit odrefresh devpts:chr_file rw_file_perms; |
| dontaudit odrefresh adbd:unix_stream_socket { getattr read write }; |
| |
| # Allow odrefresh to read /apex/apex-info-list.xml to determine |
| # whether current apex is in /system or /data. |
| allow odrefresh apex_info_file:file r_file_perms; |
| |
| # No other processes should be creating files in the staging area. |
| neverallow { domain -init -odrefresh } apex_art_staging_data_file:file open; |