Skip to content
Snippets Groups Projects
  • Jiyong Park's avatar
    86539031
    sepolicy: allow apps to execute libs embedded inside vendor apk · 86539031
    Jiyong Park authored
    Currently, some jni libs in /vendor/lib are allowed to be executed
    in java process by labelling them as same_process_hal_file. This is
    wrong because those jni libs are not in fact same process HALs.
    
    After b/37481404, those jni libs for vendor apks are embedded inside the
    apk just like downloaded apks.
    
    In order to make this possible, appdomain is allowed to execute
    vendor_app_file. Note that allowing this is not a Treble violation because
    vendor_app_file is Java and JNI code only. Native libraries in
    /vendor/lib are still prevented from being loaded in apps except for
    those are labeled as same_process_hal_file AND are loaded via the
    'sphal' namespace.
    
    Bug: 37481404
    Test: Phone application does not crash.
    Change-Id: Ifaece2f05d0b20e28c4b1c0847f5ea0bb28ade02
    86539031
    History
    sepolicy: allow apps to execute libs embedded inside vendor apk
    Jiyong Park authored
    Currently, some jni libs in /vendor/lib are allowed to be executed
    in java process by labelling them as same_process_hal_file. This is
    wrong because those jni libs are not in fact same process HALs.
    
    After b/37481404, those jni libs for vendor apks are embedded inside the
    apk just like downloaded apks.
    
    In order to make this possible, appdomain is allowed to execute
    vendor_app_file. Note that allowing this is not a Treble violation because
    vendor_app_file is Java and JNI code only. Native libraries in
    /vendor/lib are still prevented from being loaded in apps except for
    those are labeled as same_process_hal_file AND are loaded via the
    'sphal' namespace.
    
    Bug: 37481404
    Test: Phone application does not crash.
    Change-Id: Ifaece2f05d0b20e28c4b1c0847f5ea0bb28ade02