Andreas Gampe | 6d5baca | 2019-02-26 13:13:28 -0800 | [diff] [blame] | 1 | # dex2oat |
| 2 | type dex2oat, domain, coredomain; |
| 3 | type dex2oat_exec, system_file_type, exec_type, file_type; |
| 4 | |
Lokesh Gidra | 06edcd8 | 2021-03-11 11:32:47 -0800 | [diff] [blame] | 5 | userfaultfd_use(dex2oat) |
| 6 | |
Andreas Gampe | 6d5baca | 2019-02-26 13:13:28 -0800 | [diff] [blame] | 7 | r_dir_file(dex2oat, apk_data_file) |
| 8 | # Access to /vendor/app |
| 9 | r_dir_file(dex2oat, vendor_app_file) |
| 10 | # Access /vendor/framework |
| 11 | allow dex2oat vendor_framework_file:dir { getattr search }; |
| 12 | allow dex2oat vendor_framework_file:file { getattr open read map }; |
Orion Hodson | c09e7e4 | 2023-01-17 14:59:34 +0000 | [diff] [blame] | 13 | # Access /vendor/overlay |
| 14 | r_dir_file(dex2oat, vendor_overlay_file); |
Jooyung Han | 7c4f8a8 | 2023-06-09 13:26:54 +0900 | [diff] [blame] | 15 | # Vendor overlay can be found in vendor apex |
| 16 | allow dex2oat vendor_apex_metadata_file:dir { getattr search }; |
Andreas Gampe | 6d5baca | 2019-02-26 13:13:28 -0800 | [diff] [blame] | 17 | |
| 18 | allow dex2oat tmpfs:file { read getattr map }; |
| 19 | |
| 20 | r_dir_file(dex2oat, dalvikcache_data_file) |
| 21 | allow dex2oat dalvikcache_data_file:file write; |
Andreas Gampe | 6d5baca | 2019-02-26 13:13:28 -0800 | [diff] [blame] | 22 | |
| 23 | # Acquire advisory lock on /system/framework/arm/* |
| 24 | allow dex2oat system_file:file lock; |
Jeff Vander Stoep | 4c0259d | 2021-03-05 19:54:30 +0100 | [diff] [blame] | 25 | allow dex2oat postinstall_file:file lock; |
Andreas Gampe | 6d5baca | 2019-02-26 13:13:28 -0800 | [diff] [blame] | 26 | |
| 27 | # Read already open asec_apk_file file descriptors passed by installd. |
| 28 | # Also allow reading unlabeled files, to allow for upgrading forward |
| 29 | # locked APKs. |
| 30 | allow dex2oat asec_apk_file:file { read map }; |
| 31 | allow dex2oat unlabeled:file { read map }; |
| 32 | allow dex2oat oemfs:file { read map }; |
| 33 | allow dex2oat apk_tmp_file:dir search; |
| 34 | allow dex2oat apk_tmp_file:file r_file_perms; |
| 35 | allow dex2oat user_profile_data_file:file { getattr read lock map }; |
| 36 | |
| 37 | # Allow dex2oat to compile app's secondary dex files which were reported back to |
| 38 | # the framework. |
| 39 | allow dex2oat { privapp_data_file app_data_file }:file { getattr read write lock map }; |
| 40 | |
Orion Hodson | 8f75f76 | 2020-10-16 15:29:55 +0100 | [diff] [blame] | 41 | # Allow dex2oat to find files and directories under /data/misc/apexdata/com.android.runtime. |
| 42 | allow dex2oat apex_module_data_file:dir search; |
| 43 | |
Jiakai Zhang | c871c1c | 2022-07-19 21:29:31 +0100 | [diff] [blame] | 44 | # Allow dex2oat to use devpts passed from odsign. |
Martijn Coenen | 6afdb72 | 2020-11-27 12:23:54 +0100 | [diff] [blame] | 45 | allow dex2oat odsign_devpts:chr_file { read write }; |
Martijn Coenen | 6afdb72 | 2020-11-27 12:23:54 +0100 | [diff] [blame] | 46 | |
Orion Hodson | 8f75f76 | 2020-10-16 15:29:55 +0100 | [diff] [blame] | 47 | # Allow dex2oat to write to file descriptors from odrefresh for files |
| 48 | # in the staging area. |
| 49 | allow dex2oat apex_art_staging_data_file:dir r_dir_perms; |
| 50 | allow dex2oat apex_art_staging_data_file:file { getattr map read write unlink }; |
| 51 | |
| 52 | # Allow dex2oat to read artifacts from odrefresh. |
| 53 | allow dex2oat apex_art_data_file:dir r_dir_perms; |
| 54 | allow dex2oat apex_art_data_file:file r_file_perms; |
| 55 | |
Roland Levillain | d7227d8 | 2021-02-02 15:27:06 +0000 | [diff] [blame] | 56 | # Allow dex2oat to read runtime native flag properties. |
| 57 | get_prop(dex2oat, device_config_runtime_native_prop) |
| 58 | get_prop(dex2oat, device_config_runtime_native_boot_prop) |
| 59 | |
Nicolas Geoffray | 78f0250 | 2021-04-28 13:37:27 +0100 | [diff] [blame] | 60 | # Allow dex2oat to read /apex/apex-info-list.xml |
| 61 | allow dex2oat apex_info_file:file r_file_perms; |
| 62 | |
Jiakai Zhang | c871c1c | 2022-07-19 21:29:31 +0100 | [diff] [blame] | 63 | # Allow dex2oat to use file descriptors passed from privileged programs. |
| 64 | allow dex2oat { artd installd odrefresh odsign }:fd use; |
| 65 | |
Orion Hodson | c09e7e4 | 2023-01-17 14:59:34 +0000 | [diff] [blame] | 66 | # Allow dex2oat to read the /proc filesystem for CPU features, etc. |
| 67 | allow dex2oat proc_filesystems:file r_file_perms; |
| 68 | |
Andreas Gampe | 6d5baca | 2019-02-26 13:13:28 -0800 | [diff] [blame] | 69 | ################## |
| 70 | # A/B OTA Dexopt # |
| 71 | ################## |
| 72 | |
| 73 | # Allow dex2oat to use file descriptors from otapreopt. |
| 74 | allow dex2oat postinstall_dexopt:fd use; |
| 75 | |
Roland Levillain | 66f40a8 | 2019-03-13 18:52:23 +0000 | [diff] [blame] | 76 | # Allow dex2oat to read files under /postinstall (e.g. APKs under /system, /system/bin/linker). |
| 77 | allow dex2oat postinstall_file:dir r_dir_perms; |
Andreas Gampe | 6d5baca | 2019-02-26 13:13:28 -0800 | [diff] [blame] | 78 | allow dex2oat postinstall_file:filesystem getattr; |
| 79 | allow dex2oat postinstall_file:lnk_file { getattr read }; |
Andreas Gampe | 6d5baca | 2019-02-26 13:13:28 -0800 | [diff] [blame] | 80 | allow dex2oat postinstall_file:file read; |
| 81 | # Allow dex2oat to use libraries under /postinstall/system (e.g. /system/lib/libc.so). |
| 82 | # TODO(b/120266448): Remove when Bionic libraries are part of the Runtime APEX. |
| 83 | allow dex2oat postinstall_file:file { execute getattr open }; |
| 84 | |
| 85 | # Allow dex2oat access to /postinstall/apex. |
| 86 | allow dex2oat postinstall_apex_mnt_dir:dir { getattr search }; |
Martin Stjernholm | 502a036 | 2023-07-24 23:57:03 +0100 | [diff] [blame] | 87 | allow dex2oat postinstall_apex_mnt_dir:{ file lnk_file } r_file_perms; |
Andreas Gampe | 6d5baca | 2019-02-26 13:13:28 -0800 | [diff] [blame] | 88 | |
| 89 | # Allow dex2oat access to files in /data/ota. |
| 90 | allow dex2oat ota_data_file:dir ra_dir_perms; |
| 91 | allow dex2oat ota_data_file:file r_file_perms; |
| 92 | |
| 93 | # Create and read symlinks in /data/ota/dalvik-cache. This is required for PIC mode boot images, |
| 94 | # where the oat file is symlinked to the original file in /system. |
| 95 | allow dex2oat ota_data_file:lnk_file { create read }; |
| 96 | |
| 97 | # It would be nice to tie this down, but currently, because of how images are written, we can't |
| 98 | # pass file descriptors for the preopted boot image to dex2oat. So dex2oat needs to be able to |
| 99 | # create them itself (and make them world-readable). |
| 100 | allow dex2oat ota_data_file:file { create w_file_perms setattr }; |
| 101 | |
Andreas Gampe | ae127d8 | 2019-02-07 16:26:00 -0800 | [diff] [blame] | 102 | ############### |
| 103 | # APEX Update # |
| 104 | ############### |
| 105 | |
| 106 | # /dev/zero is inherited. |
| 107 | allow dex2oat apexd:fd use; |
| 108 | |
| 109 | # Allow dex2oat to use file descriptors from preinstall. |
Andreas Gampe | ae127d8 | 2019-02-07 16:26:00 -0800 | [diff] [blame] | 110 | |
Andreas Gampe | 6d5baca | 2019-02-26 13:13:28 -0800 | [diff] [blame] | 111 | ############## |
| 112 | # Neverallow # |
| 113 | ############## |
| 114 | |
Steven Moreland | f3722d5 | 2023-05-22 23:45:40 +0000 | [diff] [blame] | 115 | neverallow dex2oat app_data_file_type:notdevfile_class_set open; |