1# odrefresh 2type odrefresh, domain, coredomain; 3type odrefresh_exec, system_file_type, exec_type, file_type; 4 5# Allow odrefresh to create files and directories for on device signing. 6allow odrefresh apex_module_data_file:dir { getattr search }; 7allow odrefresh apex_art_data_file:dir { create_dir_perms relabelfrom }; 8allow odrefresh apex_art_data_file:file create_file_perms; 9 10# Allow odrefresh to create data files (typically for metrics before statsd starts). 11allow odrefresh odrefresh_data_file:dir create_dir_perms; 12allow odrefresh odrefresh_data_file:file create_file_perms; 13 14userfaultfd_use(odrefresh) 15 16# Staging area labels (/data/misc/apexdata/com.android.art/staging). odrefresh 17# sets up files here and passes file descriptors for dex2oat to write to. 18allow odrefresh apex_art_staging_data_file:dir { create_dir_perms relabelto }; 19allow odrefresh apex_art_staging_data_file:file create_file_perms; 20 21# Run dex2oat in its own sandbox. 22domain_auto_trans(odrefresh, dex2oat_exec, dex2oat) 23 24# Allow odrefresh to kill dex2oat if compilation times out. 25allow odrefresh dex2oat:process sigkill; 26 27# Run dexoptanalyzer in its own sandbox. 28domain_auto_trans(odrefresh, dexoptanalyzer_exec, dexoptanalyzer) 29 30# Allow odrefresh to kill dexoptanalyzer if analysis times out. 31allow odrefresh dexoptanalyzer:process sigkill; 32 33# Use devpts and fd from odsign (which exec()'s odrefresh) 34allow odrefresh odsign_devpts:chr_file { read write }; 35allow odrefresh odsign:fd use; 36 37# Allow odrefresh to read /apex/apex-info-list.xml to determine 38# whether current apex is in /system or /data. 39allow odrefresh apex_info_file:file r_file_perms; 40 41# Allow updating boot animation status. 42set_prop(odrefresh, bootanim_system_prop) 43 44# Allow query ART device config properties 45get_prop(odrefresh, device_config_runtime_native_prop) 46get_prop(odrefresh, device_config_runtime_native_boot_prop) 47 48# Do not audit unused resources from parent processes (adb, shell, su). 49# These appear to be unnecessary for odrefresh. 50dontaudit odrefresh { adbd shell }:fd use; 51dontaudit odrefresh devpts:chr_file rw_file_perms; 52dontaudit odrefresh adbd:unix_stream_socket { getattr read write }; 53 54# No other processes should be creating files in the staging area. 55neverallow { domain -init -odrefresh -compos_fd_server } apex_art_staging_data_file:file open; 56 57# No processes other than init, odrefresh and system_server access 58# odrefresh_data_files. 59neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:dir *; 60neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:file *; 61