1*e4a36f41SAndroid Build Coastguard Worker# idmap, when executed by installd 2*e4a36f41SAndroid Build Coastguard Workertype idmap, domain; 3*e4a36f41SAndroid Build Coastguard Workertype idmap_exec, system_file_type, exec_type, file_type; 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Worker# TODO remove /system/bin/idmap and the link between idmap and installd (b/118711077) 6*e4a36f41SAndroid Build Coastguard Worker# Use open file to /data/resource-cache file inherited from installd. 7*e4a36f41SAndroid Build Coastguard Workerallow idmap installd:fd use; 8*e4a36f41SAndroid Build Coastguard Workerallow idmap resourcecache_data_file:file create_file_perms; 9*e4a36f41SAndroid Build Coastguard Workerallow idmap resourcecache_data_file:dir rw_dir_perms; 10*e4a36f41SAndroid Build Coastguard Worker 11*e4a36f41SAndroid Build Coastguard Worker# Ignore reading /proc/<pid>/maps after a fork. 12*e4a36f41SAndroid Build Coastguard Workerdontaudit idmap installd:file read; 13*e4a36f41SAndroid Build Coastguard Worker 14*e4a36f41SAndroid Build Coastguard Worker# Open and read from target and overlay apk files passed by argument. 15*e4a36f41SAndroid Build Coastguard Workerallow idmap apk_data_file:file r_file_perms; 16*e4a36f41SAndroid Build Coastguard Workerallow idmap apk_data_file:dir search; 17*e4a36f41SAndroid Build Coastguard Worker 18*e4a36f41SAndroid Build Coastguard Worker# Allow /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files 19*e4a36f41SAndroid Build Coastguard Workerallow idmap { apk_tmp_file apk_private_tmp_file }:file r_file_perms; 20*e4a36f41SAndroid Build Coastguard Workerallow idmap { apk_tmp_file apk_private_tmp_file }:dir search; 21*e4a36f41SAndroid Build Coastguard Worker 22*e4a36f41SAndroid Build Coastguard Worker# Allow apps access to /vendor/app 23*e4a36f41SAndroid Build Coastguard Workerr_dir_file(idmap, vendor_app_file) 24*e4a36f41SAndroid Build Coastguard Worker 25*e4a36f41SAndroid Build Coastguard Worker# Allow apps access to /vendor/overlay 26*e4a36f41SAndroid Build Coastguard Workerr_dir_file(idmap, vendor_overlay_file) 27*e4a36f41SAndroid Build Coastguard Worker 28*e4a36f41SAndroid Build Coastguard Worker# Allow the idmap2d binary to register as a service and communicate via AIDL 29*e4a36f41SAndroid Build Coastguard Workerbinder_use(idmap) 30*e4a36f41SAndroid Build Coastguard Workerbinder_service(idmap) 31*e4a36f41SAndroid Build Coastguard Workeradd_service(idmap, idmap_service) 32