blob: 18600d8b906ac4a2ceb170ae0650a2bb8860fd88 [file] [log] [blame]
Andreas Gampe6d5baca2019-02-26 13:13:28 -08001# dex2oat
2type dex2oat, domain, coredomain;
3type dex2oat_exec, system_file_type, exec_type, file_type;
4
Lokesh Gidra06edcd82021-03-11 11:32:47 -08005userfaultfd_use(dex2oat)
6
Andreas Gampe6d5baca2019-02-26 13:13:28 -08007r_dir_file(dex2oat, apk_data_file)
8# Access to /vendor/app
9r_dir_file(dex2oat, vendor_app_file)
10# Access /vendor/framework
11allow dex2oat vendor_framework_file:dir { getattr search };
12allow dex2oat vendor_framework_file:file { getattr open read map };
Orion Hodsonc09e7e42023-01-17 14:59:34 +000013# Access /vendor/overlay
14r_dir_file(dex2oat, vendor_overlay_file);
Jooyung Han7c4f8a82023-06-09 13:26:54 +090015# Vendor overlay can be found in vendor apex
16allow dex2oat vendor_apex_metadata_file:dir { getattr search };
Andreas Gampe6d5baca2019-02-26 13:13:28 -080017
18allow dex2oat tmpfs:file { read getattr map };
19
20r_dir_file(dex2oat, dalvikcache_data_file)
21allow dex2oat dalvikcache_data_file:file write;
Andreas Gampe6d5baca2019-02-26 13:13:28 -080022
23# Acquire advisory lock on /system/framework/arm/*
24allow dex2oat system_file:file lock;
Jeff Vander Stoep4c0259d2021-03-05 19:54:30 +010025allow dex2oat postinstall_file:file lock;
Andreas Gampe6d5baca2019-02-26 13:13:28 -080026
27# Read already open asec_apk_file file descriptors passed by installd.
28# Also allow reading unlabeled files, to allow for upgrading forward
29# locked APKs.
30allow dex2oat asec_apk_file:file { read map };
31allow dex2oat unlabeled:file { read map };
32allow dex2oat oemfs:file { read map };
33allow dex2oat apk_tmp_file:dir search;
34allow dex2oat apk_tmp_file:file r_file_perms;
35allow dex2oat user_profile_data_file:file { getattr read lock map };
36
37# Allow dex2oat to compile app's secondary dex files which were reported back to
38# the framework.
39allow dex2oat { privapp_data_file app_data_file }:file { getattr read write lock map };
40
Orion Hodson8f75f762020-10-16 15:29:55 +010041# Allow dex2oat to find files and directories under /data/misc/apexdata/com.android.runtime.
42allow dex2oat apex_module_data_file:dir search;
43
Jiakai Zhangc871c1c2022-07-19 21:29:31 +010044# Allow dex2oat to use devpts passed from odsign.
Martijn Coenen6afdb722020-11-27 12:23:54 +010045allow dex2oat odsign_devpts:chr_file { read write };
Martijn Coenen6afdb722020-11-27 12:23:54 +010046
Orion Hodson8f75f762020-10-16 15:29:55 +010047# Allow dex2oat to write to file descriptors from odrefresh for files
48# in the staging area.
49allow dex2oat apex_art_staging_data_file:dir r_dir_perms;
50allow dex2oat apex_art_staging_data_file:file { getattr map read write unlink };
51
52# Allow dex2oat to read artifacts from odrefresh.
53allow dex2oat apex_art_data_file:dir r_dir_perms;
54allow dex2oat apex_art_data_file:file r_file_perms;
55
Roland Levillaind7227d82021-02-02 15:27:06 +000056# Allow dex2oat to read runtime native flag properties.
57get_prop(dex2oat, device_config_runtime_native_prop)
58get_prop(dex2oat, device_config_runtime_native_boot_prop)
59
Nicolas Geoffray78f02502021-04-28 13:37:27 +010060# Allow dex2oat to read /apex/apex-info-list.xml
61allow dex2oat apex_info_file:file r_file_perms;
62
Jiakai Zhangc871c1c2022-07-19 21:29:31 +010063# Allow dex2oat to use file descriptors passed from privileged programs.
64allow dex2oat { artd installd odrefresh odsign }:fd use;
65
Orion Hodsonc09e7e42023-01-17 14:59:34 +000066# Allow dex2oat to read the /proc filesystem for CPU features, etc.
67allow dex2oat proc_filesystems:file r_file_perms;
68
Andreas Gampe6d5baca2019-02-26 13:13:28 -080069##################
70# A/B OTA Dexopt #
71##################
72
73# Allow dex2oat to use file descriptors from otapreopt.
74allow dex2oat postinstall_dexopt:fd use;
75
Roland Levillain66f40a82019-03-13 18:52:23 +000076# Allow dex2oat to read files under /postinstall (e.g. APKs under /system, /system/bin/linker).
77allow dex2oat postinstall_file:dir r_dir_perms;
Andreas Gampe6d5baca2019-02-26 13:13:28 -080078allow dex2oat postinstall_file:filesystem getattr;
79allow dex2oat postinstall_file:lnk_file { getattr read };
Andreas Gampe6d5baca2019-02-26 13:13:28 -080080allow dex2oat postinstall_file:file read;
81# Allow dex2oat to use libraries under /postinstall/system (e.g. /system/lib/libc.so).
82# TODO(b/120266448): Remove when Bionic libraries are part of the Runtime APEX.
83allow dex2oat postinstall_file:file { execute getattr open };
84
85# Allow dex2oat access to /postinstall/apex.
86allow dex2oat postinstall_apex_mnt_dir:dir { getattr search };
Martin Stjernholm502a0362023-07-24 23:57:03 +010087allow dex2oat postinstall_apex_mnt_dir:{ file lnk_file } r_file_perms;
Andreas Gampe6d5baca2019-02-26 13:13:28 -080088
89# Allow dex2oat access to files in /data/ota.
90allow dex2oat ota_data_file:dir ra_dir_perms;
91allow dex2oat ota_data_file:file r_file_perms;
92
93# Create and read symlinks in /data/ota/dalvik-cache. This is required for PIC mode boot images,
94# where the oat file is symlinked to the original file in /system.
95allow dex2oat ota_data_file:lnk_file { create read };
96
97# It would be nice to tie this down, but currently, because of how images are written, we can't
98# pass file descriptors for the preopted boot image to dex2oat. So dex2oat needs to be able to
99# create them itself (and make them world-readable).
100allow dex2oat ota_data_file:file { create w_file_perms setattr };
101
Andreas Gampeae127d82019-02-07 16:26:00 -0800102###############
103# APEX Update #
104###############
105
106# /dev/zero is inherited.
107allow dex2oat apexd:fd use;
108
109# Allow dex2oat to use file descriptors from preinstall.
Andreas Gampeae127d82019-02-07 16:26:00 -0800110
Andreas Gampe6d5baca2019-02-26 13:13:28 -0800111##############
112# Neverallow #
113##############
114
Steven Morelandf3722d52023-05-22 23:45:40 +0000115neverallow dex2oat app_data_file_type:notdevfile_class_set open;