1*e4a36f41SAndroid Build Coastguard Workertype migrate_legacy_obb_data, domain, coredomain; 2*e4a36f41SAndroid Build Coastguard Workertype migrate_legacy_obb_data_exec, system_file_type, exec_type, file_type; 3*e4a36f41SAndroid Build Coastguard Worker 4*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data media_rw_data_file:dir create_dir_perms; 5*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data media_rw_data_file:file create_file_perms; 6*e4a36f41SAndroid Build Coastguard Worker 7*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data shell_exec:file rx_file_perms; 8*e4a36f41SAndroid Build Coastguard Worker 9*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data toolbox_exec:file rx_file_perms; 10*e4a36f41SAndroid Build Coastguard Worker 11*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data self:capability { chown dac_override dac_read_search fowner fsetid }; 12*e4a36f41SAndroid Build Coastguard Worker 13*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data mnt_user_file:dir search; 14*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data mnt_user_file:lnk_file read; 15*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data storage_file:dir search; 16*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data storage_file:lnk_file read; 17*e4a36f41SAndroid Build Coastguard Worker 18*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data sdcard_type:dir create_dir_perms; 19*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data sdcard_type:file create_file_perms; 20*e4a36f41SAndroid Build Coastguard Worker 21*e4a36f41SAndroid Build Coastguard Worker# TODO: This should not be necessary. We don't deliberately hand over 22*e4a36f41SAndroid Build Coastguard Worker# any open file descriptors to this domain, so anything that triggers this 23*e4a36f41SAndroid Build Coastguard Worker# should be a candidate for O_CLOEXEC. 24*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data installd:fd use; 25*e4a36f41SAndroid Build Coastguard Worker 26*e4a36f41SAndroid Build Coastguard Worker# This rule is required to let this process read /proc/{parent_pid}/mount. 27*e4a36f41SAndroid Build Coastguard Worker# TODO: Why is this required ? 28*e4a36f41SAndroid Build Coastguard Workerallow migrate_legacy_obb_data installd:file read; 29