1# otapreopt_chroot executable 2starting_at_board_api(202504, `type otapreopt_chroot, domain;') 3typeattribute otapreopt_chroot coredomain; 4type otapreopt_chroot_exec, exec_type, file_type, system_file_type; 5 6# Chroot preparation and execution. 7# We need to create an unshared mount namespace, and then mount /data. 8allow otapreopt_chroot postinstall_file:dir { search mounton }; 9allow otapreopt_chroot apex_mnt_dir:dir mounton; 10allow otapreopt_chroot device:dir mounton; 11allow otapreopt_chroot linkerconfig_file:dir mounton; 12allow otapreopt_chroot rootfs:dir mounton; 13allow otapreopt_chroot sysfs:dir mounton; 14allow otapreopt_chroot system_data_root_file:dir mounton; 15allow otapreopt_chroot system_file:dir mounton; 16allow otapreopt_chroot vendor_file:dir mounton; 17allow otapreopt_chroot self:global_capability_class_set { sys_admin sys_chroot }; 18 19# This is required to mount /vendor and mount/unmount ext4 images from 20# APEX packages in /postinstall/apex. 21allow otapreopt_chroot block_device:dir search; 22allow otapreopt_chroot labeledfs:filesystem { mount unmount }; 23# This is required for dynamic partitions. 24allow otapreopt_chroot dm_device:chr_file rw_file_perms; 25 26# This is required to unmount flattened APEX packages under 27# /postinstall/system/apex (which are bind-mounted in /postinstall/apex). 28allow otapreopt_chroot postinstall_file:filesystem unmount; 29# Mounting /vendor can have this side-effect. Ignore denial. 30dontaudit otapreopt_chroot kernel:process setsched; 31 32# Allow otapreopt_chroot to read SELinux policy files. 33allow otapreopt_chroot file_contexts_file:file r_file_perms; 34 35# Allow otapreopt_chroot to open and read the contents of /postinstall/system/apex. 36allow otapreopt_chroot postinstall_file:dir r_dir_perms; 37# Allow otapreopt_chroot to read the persist.apexd.verity_on_system system property. 38get_prop(otapreopt_chroot, apexd_prop) 39 40# Allow otapreopt to use file descriptors from update-engine and the postinstall 41# script. It will read dexopt commands from stdin and write progress to stdout. 42allow otapreopt_chroot postinstall:fd use; 43allow otapreopt_chroot postinstall:fifo_file { read write getattr }; 44allow otapreopt_chroot update_engine:fd use; 45allow otapreopt_chroot update_engine:fifo_file write; 46 47# Allow to transition to postinstall_dexopt, to run otapreopt in its own sandbox. 48domain_auto_trans(otapreopt_chroot, postinstall_dexopt_exec, postinstall_dexopt) 49domain_auto_trans(otapreopt_chroot, linkerconfig_exec, linkerconfig) 50domain_auto_trans(otapreopt_chroot, apexd_exec, apexd) 51 52# Allow otapreopt_chroot to control linkerconfig 53allow otapreopt_chroot linkerconfig_file:dir { create_dir_perms relabelto }; 54allow otapreopt_chroot linkerconfig_file:file create_file_perms; 55 56# Allow otapreopt_chroot to create loop devices with /dev/loop-control. 57allow otapreopt_chroot loop_control_device:chr_file rw_file_perms; 58# Allow otapreopt_chroot to access loop devices. 59allow otapreopt_chroot loop_device:blk_file rw_file_perms; 60allowxperm otapreopt_chroot loop_device:blk_file ioctl { 61 LOOP_CONFIGURE 62 LOOP_GET_STATUS64 63 LOOP_SET_STATUS64 64 LOOP_SET_FD 65 LOOP_SET_BLOCK_SIZE 66 LOOP_SET_DIRECT_IO 67 LOOP_CLR_FD 68 BLKFLSBUF 69}; 70 71# Allow otapreopt_chroot to configure read-ahead of loop devices. 72allow otapreopt_chroot sysfs_loop:dir r_dir_perms; 73allow otapreopt_chroot sysfs_loop:file rw_file_perms; 74 75# Allow otapreopt_chroot to mount a tmpfs filesystem in /postinstall/apex. 76allow otapreopt_chroot tmpfs:filesystem mount; 77# Allow otapreopt_chroot to restore the security context of /postinstall/apex. 78allow otapreopt_chroot tmpfs:dir relabelfrom; 79allow otapreopt_chroot postinstall_apex_mnt_dir:dir relabelto; 80 81# Allow otapreopt_chroot to manipulate directory /postinstall/apex. 82allow otapreopt_chroot postinstall_apex_mnt_dir:dir create_dir_perms; 83allow otapreopt_chroot postinstall_apex_mnt_dir:file create_file_perms; 84# Allow otapreopt_chroot to mount APEX packages in /postinstall/apex. 85allow otapreopt_chroot postinstall_apex_mnt_dir:dir mounton; 86 87# Allow otapreopt_chroot to access /dev/block (needed to detach loop 88# devices used by ext4 images from APEX packages). 89allow otapreopt_chroot block_device:dir r_dir_perms; 90 91# Allow to access the linker through the symlink. 92allow otapreopt_chroot postinstall_file:lnk_file r_file_perms; 93 94# Allow otapreopt_chroot to read ro.cold_boot_done prop. 95# This is a temporary solution to make sure that otapreopt_chroot doesn't block indefinetelly. 96# TODO(b/165948777): remove this once otapreopt_chroot is migrated to libapexmount. 97get_prop(otapreopt_chroot, cold_boot_done_prop) 98 99# allow otapreopt_chroot to run the linkerconfig from the new image. 100allow otapreopt_chroot linkerconfig_exec:file rx_file_perms; 101