1# otapreopt_chroot executable 2typeattribute otapreopt_chroot coredomain; 3type otapreopt_chroot_exec, exec_type, file_type, system_file_type; 4 5# Chroot preparation and execution. 6# We need to create an unshared mount namespace, and then mount /data. 7allow otapreopt_chroot postinstall_file:dir { search mounton }; 8allow otapreopt_chroot apex_mnt_dir:dir mounton; 9allow otapreopt_chroot device:dir mounton; 10allow otapreopt_chroot linkerconfig_file:dir mounton; 11allow otapreopt_chroot rootfs:dir mounton; 12allow otapreopt_chroot sysfs:dir mounton; 13allow otapreopt_chroot system_data_root_file:dir mounton; 14allow otapreopt_chroot system_file:dir mounton; 15allow otapreopt_chroot vendor_file:dir mounton; 16allow otapreopt_chroot self:global_capability_class_set { sys_admin sys_chroot }; 17 18# This is required to mount /vendor and mount/unmount ext4 images from 19# APEX packages in /postinstall/apex. 20allow otapreopt_chroot block_device:dir search; 21allow otapreopt_chroot labeledfs:filesystem { mount unmount }; 22# This is required for dynamic partitions. 23allow otapreopt_chroot dm_device:chr_file rw_file_perms; 24 25# This is required to unmount flattened APEX packages under 26# /postinstall/system/apex (which are bind-mounted in /postinstall/apex). 27allow otapreopt_chroot postinstall_file:filesystem unmount; 28# Mounting /vendor can have this side-effect. Ignore denial. 29dontaudit otapreopt_chroot kernel:process setsched; 30 31# Allow otapreopt_chroot to read SELinux policy files. 32allow otapreopt_chroot file_contexts_file:file r_file_perms; 33 34# Allow otapreopt_chroot to open and read the contents of /postinstall/system/apex. 35allow otapreopt_chroot postinstall_file:dir r_dir_perms; 36# Allow otapreopt_chroot to read the persist.apexd.verity_on_system system property. 37get_prop(otapreopt_chroot, apexd_prop) 38 39# Allow otapreopt to use file descriptors from update-engine and the postinstall 40# script. It will read dexopt commands from stdin and write progress to stdout. 41allow otapreopt_chroot postinstall:fd use; 42allow otapreopt_chroot postinstall:fifo_file { read write getattr }; 43allow otapreopt_chroot update_engine:fd use; 44allow otapreopt_chroot update_engine:fifo_file write; 45 46# Allow to transition to postinstall_dexopt, to run otapreopt in its own sandbox. 47domain_auto_trans(otapreopt_chroot, postinstall_dexopt_exec, postinstall_dexopt) 48domain_auto_trans(otapreopt_chroot, linkerconfig_exec, linkerconfig) 49domain_auto_trans(otapreopt_chroot, apexd_exec, apexd) 50 51# Allow otapreopt_chroot to control linkerconfig 52allow otapreopt_chroot linkerconfig_file:dir { create_dir_perms relabelto }; 53allow otapreopt_chroot linkerconfig_file:file create_file_perms; 54 55# Allow otapreopt_chroot to create loop devices with /dev/loop-control. 56allow otapreopt_chroot loop_control_device:chr_file rw_file_perms; 57# Allow otapreopt_chroot to access loop devices. 58allow otapreopt_chroot loop_device:blk_file rw_file_perms; 59allowxperm otapreopt_chroot loop_device:blk_file ioctl { 60 LOOP_CONFIGURE 61 LOOP_GET_STATUS64 62 LOOP_SET_STATUS64 63 LOOP_SET_FD 64 LOOP_SET_BLOCK_SIZE 65 LOOP_SET_DIRECT_IO 66 LOOP_CLR_FD 67 BLKFLSBUF 68}; 69 70# Allow otapreopt_chroot to configure read-ahead of loop devices. 71allow otapreopt_chroot sysfs_loop:dir r_dir_perms; 72allow otapreopt_chroot sysfs_loop:file rw_file_perms; 73 74# Allow otapreopt_chroot to mount a tmpfs filesystem in /postinstall/apex. 75allow otapreopt_chroot tmpfs:filesystem mount; 76# Allow otapreopt_chroot to restore the security context of /postinstall/apex. 77allow otapreopt_chroot tmpfs:dir relabelfrom; 78allow otapreopt_chroot postinstall_apex_mnt_dir:dir relabelto; 79 80# Allow otapreopt_chroot to manipulate directory /postinstall/apex. 81allow otapreopt_chroot postinstall_apex_mnt_dir:dir create_dir_perms; 82allow otapreopt_chroot postinstall_apex_mnt_dir:file create_file_perms; 83# Allow otapreopt_chroot to mount APEX packages in /postinstall/apex. 84allow otapreopt_chroot postinstall_apex_mnt_dir:dir mounton; 85 86# Allow otapreopt_chroot to access /dev/block (needed to detach loop 87# devices used by ext4 images from APEX packages). 88allow otapreopt_chroot block_device:dir r_dir_perms; 89 90# Allow to access the linker through the symlink. 91allow otapreopt_chroot postinstall_file:lnk_file r_file_perms; 92 93# Allow otapreopt_chroot to read ro.cold_boot_done prop. 94# This is a temporary solution to make sure that otapreopt_chroot doesn't block indefinetelly. 95# TODO(b/165948777): remove this once otapreopt_chroot is migrated to libapexmount. 96get_prop(otapreopt_chroot, cold_boot_done_prop) 97 98# allow otapreopt_chroot to run the linkerconfig from the new image. 99allow otapreopt_chroot linkerconfig_exec:file rx_file_perms; 100