| # idmap, when executed by installd |
| type idmap, domain; |
| type idmap_exec, system_file_type, exec_type, file_type; |
| |
| # Allow read + write access to /data/resource-cache |
| allow idmap resourcecache_data_file:file create_file_perms; |
| allow idmap resourcecache_data_file:dir rw_dir_perms; |
| |
| # Open and read from target and overlay apk files passed by argument. |
| allow idmap apk_data_file:file r_file_perms; |
| allow idmap apk_data_file:dir search; |
| |
| # Allow /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files |
| allow idmap { apk_tmp_file apk_private_tmp_file }:file r_file_perms; |
| allow idmap { apk_tmp_file apk_private_tmp_file }:dir search; |
| |
| # Allow apps access to /vendor/app |
| r_dir_file(idmap, vendor_app_file) |
| |
| # Allow apps access to /vendor/overlay |
| r_dir_file(idmap, vendor_overlay_file) |
| |
| # Allow the idmap2d binary to register as a service and communicate via AIDL |
| binder_use(idmap) |
| binder_service(idmap) |
| add_service(idmap, idmap_service) |