diff options
Diffstat (limited to 'installd.te')
| -rw-r--r-- | installd.te | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/installd.te b/installd.te index 6b1b2b8..3f685f1 100644 --- a/installd.te +++ b/installd.te @@ -5,15 +5,18 @@ type installd_exec, exec_type, file_type; init_daemon_domain(installd) typeattribute installd mlstrustedsubject; allow installd self:capability { chown dac_override fowner fsetid setgid setuid }; -allow installd apk_data_file:file rename; -allow installd apk_data_file:dir create_dir_perms; +allow installd apk_data_file:file { rename unlink }; +allow installd dalvikcache_data_file:dir relabelto; +allow installd apk_data_file:dir { create_dir_perms relabelfrom }; allow installd apk_data_file:lnk_file { create read unlink }; allow installd asec_apk_file:file r_file_perms; -allow installd apk_tmp_file:file r_file_perms; +allow installd apk_tmp_file:file { r_file_perms unlink }; +allow installd apk_tmp_file:dir { relabelfrom create_dir_perms }; allow installd oemfs:dir r_dir_perms; allow installd oemfs:file r_file_perms; allow installd system_file:file x_file_perms; allow installd cgroup:dir create_dir_perms; +allow installd mnt_expand_file:dir search; # Check validity of SELinux context before use. selinux_check_context(installd) # Read /seapp_contexts and /data/security/seapp_contexts @@ -61,9 +64,6 @@ allow installd resourcecache_data_file:file create_file_perms; # Run dex2oat in its own sandbox. domain_auto_trans(installd, dex2oat_exec, dex2oat) -# dex2oat needs LD_PRELOAD, passed down from init -# https://android-review.googlesource.com/94851 -allow installd dex2oat:process noatsecure; # Upgrade from unlabeled userdata. # Just need enough to remove and/or relabel it. @@ -83,5 +83,7 @@ allow installd system_data_file:notdevfile_class_set { getattr relabelfrom unlin # upon package uninstall. # Types extracted from seapp_contexts type= fields. allow installd { system_app_data_file bluetooth_data_file nfc_data_file radio_data_file shell_data_file app_data_file }:dir { create_dir_perms relabelfrom relabelto }; -allow installd { system_app_data_file bluetooth_data_file nfc_data_file radio_data_file shell_data_file app_data_file }:lnk_file { create setattr getattr unlink rename relabelfrom relabelto }; -allow installd { system_app_data_file bluetooth_data_file nfc_data_file radio_data_file shell_data_file app_data_file }:{ file sock_file fifo_file } { getattr unlink rename relabelfrom relabelto setattr }; +allow installd { system_app_data_file bluetooth_data_file nfc_data_file radio_data_file shell_data_file app_data_file }:notdevfile_class_set { create_file_perms relabelfrom relabelto }; + +# Create and use pty created by android_fork_execvp(). +allow installd devpts:chr_file rw_file_perms; |