1# odrefresh 2type odrefresh, domain, coredomain, artd_subprocess_type; 3type odrefresh_exec, system_file_type, exec_type, file_type; 4 5# Allow odrefresh to create files and directories for on device signing. 6allow odrefresh apex_module_data_file:dir { getattr search }; 7allow odrefresh apex_art_data_file:dir { create_dir_perms relabelfrom }; 8allow odrefresh apex_art_data_file:file { create_file_perms relabelto } ; 9 10# Allow odrefresh to create data files (typically for metrics before statsd starts). 11allow odrefresh odrefresh_data_file:dir create_dir_perms; 12allow odrefresh odrefresh_data_file:file create_file_perms; 13 14userfaultfd_use(odrefresh) 15 16# Staging area labels (/data/misc/apexdata/com.android.art/staging). odrefresh 17# sets up files here and passes file descriptors for dex2oat to write to. 18allow odrefresh apex_art_staging_data_file:dir { create_dir_perms relabelto }; 19allow odrefresh apex_art_staging_data_file:file { create_file_perms relabelfrom }; 20 21# Run dex2oat in its own sandbox. 22domain_auto_trans(odrefresh, dex2oat_exec, dex2oat) 23 24# Allow odrefresh to kill dex2oat if compilation times out. 25allow odrefresh dex2oat:process sigkill; 26 27# Use devpts and fd from odsign (which exec()'s odrefresh) 28allow odrefresh odsign_devpts:chr_file { read write }; 29allow odrefresh odsign:fd use; 30 31# Allow odrefresh to read /apex/apex-info-list.xml to determine 32# whether current apex is in /system or /data. 33allow odrefresh apex_info_file:file r_file_perms; 34 35# Allow updating boot animation status. 36set_prop(odrefresh, bootanim_system_prop) 37 38# Allow query ART device config properties 39get_prop(odrefresh, device_config_runtime_native_prop) 40get_prop(odrefresh, device_config_runtime_native_boot_prop) 41 42# Do not audit unused resources from parent processes (adb, shell, su). 43# These appear to be unnecessary for odrefresh. 44dontaudit odrefresh { adbd shell }:fd use; 45dontaudit odrefresh devpts:chr_file rw_file_perms; 46dontaudit odrefresh adbd:unix_stream_socket { getattr read write }; 47 48# Read access to SELinux context files, for restorecon. 49allow odrefresh file_contexts_file:file r_file_perms; 50allow odrefresh seapp_contexts_file:file r_file_perms; 51 52# Check validity of SELinux context, for restorecon. 53selinux_check_context(odrefresh) 54 55# odrefresh iterates over all properties to find the ones that it's interested 56# in. It's okay to ignore denials on other properties. 57dontaudit odrefresh property_type:file r_file_perms; 58 59# Allow to be called by artd in Pre-reboot Dexopt. 60allow odrefresh artd:fd use; 61 62# Neverallow rules. 63 64# No other processes should be creating files in the staging area. 65neverallow { domain -init -odrefresh -compos_fd_server } apex_art_staging_data_file:file open; 66 67# No processes other than init, odrefresh, system_server, and artd access 68# odrefresh_data_files. 69# Among those, artd only needs to bind-mount /data/misc/odrefresh, but doesn't 70# need to access the files. 71neverallow { domain -init -odrefresh -system_server -artd } odrefresh_data_file:dir *; 72neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:file *; 73