diff --git a/Android.mk b/Android.mk
index fb2a602fffe1a03fd3e24ed9d86ae5013e6cbdc9..6af3af912bbd1abea06c5819a2175042f22d2fcd 100644
--- a/Android.mk
+++ b/Android.mk
@@ -139,6 +139,7 @@ $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
-D target_build_variant=$(TARGET_BUILD_VARIANT) \
-D target_build_treble=$(ENABLE_TREBLE) \
+ -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
-s $^ > $@
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
@@ -156,6 +157,7 @@ $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(BOARD_SEPOLICY_DIRS))
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
-D target_build_variant=$(TARGET_BUILD_VARIANT) \
-D target_build_treble=$(ENABLE_TREBLE) \
+ -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
-D target_arch=$(LOCAL_TARGET_ARCH) \
-s $^ > $@
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
@@ -197,6 +199,7 @@ $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY) $(BOARD_SEPOLICY_DIRS))
-D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
-D target_build_variant=$(TARGET_BUILD_VARIANT) \
-D target_build_treble=$(ENABLE_TREBLE) \
+ -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
-D target_recovery=true \
-s $^ > $@
@@ -233,6 +236,7 @@ $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
$(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) \
-D target_build_variant=user \
-D target_build_treble=$(ENABLE_TREBLE) \
+ -D target_with_dexpreopt=$(WITH_DEXPREOPT) \
-s $^ > $@
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
diff --git a/public/te_macros b/public/te_macros
index 65703dab43024ed7616a62523d69f139cc2b33b3..9664b3196894732c0bb588975d4f3709d8a7023a 100644
--- a/public/te_macros
+++ b/public/te_macros
@@ -288,6 +288,12 @@ define(`eng', ifelse(target_build_variant, `eng', $1))
define(`binderized_hal', ifelse(target_build_treble, `true', $1))
define(`passthrough_hal', ifelse(target_build_treble, `', $1))
+#####################################
+# WITH_DEXPREOPT builds
+# SELinux rules which apply only when pre-opting.
+#
+define(`with_dexpreopt', ifelse(target_with_dexpreopt, `true', $1))
+
#####################################
# write_logd(domain)
# Ability to write to android log
diff --git a/public/zygote.te b/public/zygote.te
index 08e6e3c1b8b674c010627245b40c4b817c73078f..b2374f172ea61f710bc5fcbb9a44147a3717921e 100644
--- a/public/zygote.te
+++ b/public/zygote.te
@@ -3,46 +3,61 @@ type zygote, domain, domain_deprecated;
type zygote_exec, exec_type, file_type;
typeattribute zygote mlstrustedsubject;
+
# Override DAC on files and switch uid/gid.
allow zygote self:capability { dac_override setgid setuid fowner chown };
+
# Drop capabilities from bounding set.
allow zygote self:capability setpcap;
+
# Switch SELinux context to app domains.
allow zygote self:process setcurrent;
allow zygote system_server:process dyntransition;
allow zygote { appdomain ephemeral_app }:process dyntransition;
-# Allow zygote to read app /proc/pid dirs (b/10455872)
+
+# Allow zygote to read app /proc/pid dirs (b/10455872).
allow zygote { appdomain ephemeral_app }:dir { getattr search };
allow zygote { appdomain ephemeral_app }:file { r_file_perms };
+
# Move children into the peer process group.
allow zygote system_server:process { getpgid setpgid };
allow zygote { appdomain ephemeral_app }:process { getpgid setpgid };
+
# Read system data.
allow zygote system_data_file:dir r_dir_perms;
allow zygote system_data_file:file r_file_perms;
+
# Write to /data/dalvik-cache.
allow zygote dalvikcache_data_file:dir create_dir_perms;
allow zygote dalvikcache_data_file:file create_file_perms;
-# Create symlinks in /data/dalvik-cache
+
+# Create symlinks in /data/dalvik-cache.
allow zygote dalvikcache_data_file:lnk_file create_file_perms;
-# Write to /data/resource-cache
+
+# Write to /data/resource-cache.
allow zygote resourcecache_data_file:dir rw_dir_perms;
allow zygote resourcecache_data_file:file create_file_perms;
+
# For art.
-allow zygote dalvikcache_data_file:file execute;
allow zygote libart_file:file { execute read open getattr };
+# When WITH_DEXPREOPT is true, the zygote does not load executable content from
+# /data/dalvik-cache.
+allow { zygote with_dexpreopt(`-zygote') } dalvikcache_data_file:file execute;
+
# Execute idmap and dex2oat within zygote's own domain.
# TODO: Should either of these be transitioned to the same domain
# used by installd or stay in-domain for zygote?
allow zygote idmap_exec:file rx_file_perms;
allow zygote dex2oat_exec:file rx_file_perms;
+
# Control cgroups.
allow zygote cgroup:dir create_dir_perms;
allow zygote cgroup:{ file lnk_file } r_file_perms;
allow zygote self:capability sys_admin;
+
# Allow zygote to stat the files that it opens. The zygote must
# be able to inspect them so that it can reopen them on fork
-# if necessary: b/30963384
+# if necessary: b/30963384.
allow zygote pmsg_device:chr_file { getattr };
allow zygote debugfs_trace_marker:file { getattr };
@@ -55,13 +70,13 @@ selinux_check_access(zygote)
# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount
allow zygote proc_cpuinfo:file mounton;
-# Allow remounting rootfs as MS_SLAVE
+# Allow remounting rootfs as MS_SLAVE.
allow zygote rootfs:dir mounton;
allow zygote tmpfs:filesystem { mount unmount };
allow zygote fuse:filesystem { unmount };
allow zygote sdcardfs:filesystem { unmount };
-# Allowed to create user-specific storage source if started before vold
+# Allow creating user-specific storage source if started before vold.
allow zygote mnt_user_file:dir create_dir_perms;
allow zygote mnt_user_file:lnk_file create_file_perms;
# Allowed to mount user-specific storage into place
@@ -88,7 +103,7 @@ userdebug_or_eng(`
allow zygote ion_device:chr_file r_file_perms;
allow zygote tmpfs:dir r_dir_perms;
-# Let the zygote access overlays so it can initialize the AssetManager
+# Let the zygote access overlays so it can initialize the AssetManager.
get_prop(zygote, overlay_prop)
###