diff options
author | Narayan Kamath <narayan@google.com> | 2015-05-14 14:01:24 +0100 |
---|---|---|
committer | Narayan Kamath <narayan@google.com> | 2015-06-04 11:07:24 +0000 |
commit | 41f233f4658f20ac36845ed262bfeb8a7a9eea45 (patch) | |
tree | dd253b02dcfdb676fff1213250edb0e623278ce7 /system_server.te | |
parent | 7e0838aaebc5c0a04df2f13ccef176a9096e4dc3 (diff) | |
download | android_external_sepolicy-41f233f4658f20ac36845ed262bfeb8a7a9eea45.tar.gz android_external_sepolicy-41f233f4658f20ac36845ed262bfeb8a7a9eea45.tar.bz2 android_external_sepolicy-41f233f4658f20ac36845ed262bfeb8a7a9eea45.zip |
Allow system_server to link,relabel and create_dir dalvikcache_data_file.
Required by the installation flow for split APKs.
bug: 20889739
Change-Id: I3e14335f3bcfe76d1d24d233f53a728a6d90e8a1
Diffstat (limited to 'system_server.te')
-rw-r--r-- | system_server.te | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/system_server.te b/system_server.te index 0b18eb4..5d1398a 100644 --- a/system_server.te +++ b/system_server.te @@ -16,6 +16,25 @@ allow system_server system_server_tmpfs:file execute; allow system_server dalvikcache_data_file:file execute; allow system_server dalvikcache_data_file:dir r_dir_perms; +# For PackageInstallerSession. +# +# All of these rules relate to the installation and compilation of split +# APKs. Roughly, the process is as follows. The rules below only pertain +# to step (3) of the process +# +# (1) Create a staging directory. +# (2) Link existing APKs from the split +# +# (3) Link existing compiled oat files : This requires "create_dir_perms" +# to create oat directories (foo/oat and foo/oat/x86), "relabelto" to +# make sure they have the right label, and "link" to link files. +# +# (3) Invoke dex2oat to compile the updated / new split +# (4) Rename the staging directory back to the final path. +allow system_server dalvikcache_data_file:file link; +allow system_server dalvikcache_data_file:dir relabelto; +allow system_server dalvikcache_data_file:dir create_dir_perms; + # /data/resource-cache allow system_server resourcecache_data_file:file r_file_perms; allow system_server resourcecache_data_file:dir r_dir_perms; |