diff --git a/file.te b/file.te index b019678b414f48a227ab07c73babcb8d138d9fd8..0e443278f6363efc6072fe82dd5b1e931bda7d2f 100644 --- a/file.te +++ b/file.te @@ -107,6 +107,8 @@ type heapdump_data_file, file_type, data_file_type, mlstrustedobject; type nativetest_data_file, file_type, data_file_type; # /data/system_de/0/ringtones type ringtone_file, file_type, data_file_type, mlstrustedobject; +# /data/preloads +type preloads_data_file, file_type, data_file_type; # Mount locations managed by vold type mnt_media_rw_file, file_type; diff --git a/file_contexts b/file_contexts index 8266315244f5187b7dc9a6fbf8ff437d24bf5aa4..d17a54fedb827c24998a4cf1d2698473268c04b5 100644 --- a/file_contexts +++ b/file_contexts @@ -253,6 +253,7 @@ /data/mediadrm(/.*)? u:object_r:media_data_file:s0 /data/nativetest(/.*)? u:object_r:nativetest_data_file:s0 /data/property(/.*)? u:object_r:property_data_file:s0 +/data/preloads(/.*)? u:object_r:preloads_data_file:s0 # Misc data /data/misc/adb(/.*)? u:object_r:adb_keys_file:s0 diff --git a/platform_app.te b/platform_app.te index 8ac79327e0a84bc967a0e0010317539a252ff1f3..0d3bdba1cd463689fe1c02c98990c707964ccfa0 100644 --- a/platform_app.te +++ b/platform_app.te @@ -51,3 +51,7 @@ allow platform_app surfaceflinger_service:service_manager find; allow platform_app app_api_service:service_manager find; allow platform_app system_api_service:service_manager find; allow platform_app vr_manager_service:service_manager find; + +# Access to /data/preloads +allow platform_app preloads_data_file:file r_file_perms; +allow platform_app preloads_data_file:dir r_dir_perms; diff --git a/priv_app.te b/priv_app.te index 58016195a7a7ab837aa74951e6e2d491238e0959..d380a67a2252b63b955adcf4cf42094df574fe2f 100644 --- a/priv_app.te +++ b/priv_app.te @@ -92,6 +92,10 @@ allow priv_app update_engine_service:service_manager find; # Allow Phone to read/write cached ringtones (opened by system). allow priv_app ringtone_file:file { getattr read write }; +# Access to /data/preloads +allow priv_app preloads_data_file:file r_file_perms; +allow priv_app preloads_data_file:dir r_dir_perms; + ### ### neverallow rules ### diff --git a/system_server.te b/system_server.te index 71573de6a2eecde016d6de0b6fa0d4a5caca4254..9e866ff9e4df4434fcb3af0dd25a31b1cdea613c 100644 --- a/system_server.te +++ b/system_server.te @@ -522,6 +522,10 @@ allow system_server postinstall:fifo_file write; allow system_server update_engine:fd use; allow system_server update_engine:fifo_file write; +# Access to /data/preloads +allow system_server preloads_data_file:file { r_file_perms unlink }; +allow system_server preloads_data_file:dir { r_dir_perms write remove_name }; + ### ### Neverallow rules ###