Skip to content
Snippets Groups Projects
Commit 61dfd0ee authored by Andreas Gampe's avatar Andreas Gampe Committed by android-build-merger
Browse files

Merge "Sepolicy: Add search rights for A/B dexopt" into nyc-mr1-dev am: 9072d0dd

am: b7d8bb27

* commit 'b7d8bb27':
  Sepolicy: Add search rights for A/B dexopt

Change-Id: I0dae7b761450b12d4f294866f57a8089eb541296
parents 8db82311 b7d8bb27
No related branches found
No related tags found
No related merge requests found
......@@ -29,7 +29,7 @@ allow dex2oat user_profile_data_file:file { getattr read lock };
# Allow dex2oat to use file descriptors from otapreopt.
allow dex2oat postinstall_dexopt:fd use;
allow dex2oat postinstall_file:dir getattr;
allow dex2oat postinstall_file:dir { getattr search };
# Allow dex2oat access to files in /data/ota.
allow dex2oat ota_data_file:dir ra_dir_perms;
......
......@@ -8,7 +8,7 @@ type postinstall_dexopt, domain;
# init_daemon_domain(otapreopt)
allow postinstall_dexopt self:capability { chown dac_override fowner setgid setuid };
allow postinstall_dexopt postinstall_file:dir getattr;
allow postinstall_dexopt postinstall_file:dir { getattr search };
allow postinstall_dexopt proc:file { getattr open read };
allow postinstall_dexopt tmpfs:file read;
......@@ -53,3 +53,5 @@ allow postinstall_dexopt installd:process sigchld;
# Allow otapreopt to use file descriptors from otapreopt_chroot.
# TODO: Probably we can actually close file descriptors...
allow postinstall_dexopt otapreopt_chroot:fd use;
allow postinstall_dexopt cpuctl_device:dir search;
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment