diff options
author | alk3pInjection <webmaster@raspii.tech> | 2022-05-01 21:36:16 +0800 |
---|---|---|
committer | alk3pInjection <webmaster@raspii.tech> | 2022-05-01 21:36:16 +0800 |
commit | 329b113bc1329f83fe1eecd32213435f8885ca71 (patch) | |
tree | af249b7fce9300b5248cbffe94a08d48fb919f73 /prebuilts/api/32.0/private/viewcompiler.te | |
parent | 18c07b58901c9d0e7fc0d908ed38146847bab5b3 (diff) | |
parent | d7b93dbd049c0eacfb7ad14677457836c79b38f6 (diff) |
Merge tag 'LA.QSSI.12.0.r1-06800-qssi.0' into sugisawa-mr1HEADsugisawa-mr1
"LA.QSSI.12.0.r1-06800-qssi.0"
Change-Id: I35dbb71151ce8b3bf68b425732a761532c638017
Diffstat (limited to 'prebuilts/api/32.0/private/viewcompiler.te')
-rw-r--r-- | prebuilts/api/32.0/private/viewcompiler.te | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/prebuilts/api/32.0/private/viewcompiler.te b/prebuilts/api/32.0/private/viewcompiler.te new file mode 100644 index 000000000..d1f096441 --- /dev/null +++ b/prebuilts/api/32.0/private/viewcompiler.te @@ -0,0 +1,25 @@ +# viewcompiler +type viewcompiler, domain, coredomain, mlstrustedsubject; +type viewcompiler_exec, system_file_type, exec_type, file_type; +type viewcompiler_tmpfs, file_type; + +# Reading an APK opens a ZipArchive, which unpack to tmpfs. +# Use tmpfs_domain() which will give tmpfs files created by viewcompiler their +# own label, which differs from other labels created by other processes. +# This allows to distinguish in policy files created by viewcompiler vs other +# processes. +tmpfs_domain(viewcompiler) + +allow viewcompiler installd:fd use; + +# Include write permission for app data files so viewcompiler can generate +# compiled layout dex files +allow viewcompiler app_data_file:file { getattr write }; + +# Allow the view compiler to read resources from the apps APK. +allow viewcompiler apk_data_file:file { read map }; + +# priv-apps are moving to a world where they can only execute +# signed code. Make sure viewcompiler never can write to privapp +# directories to avoid introducing unsigned executable code +neverallow viewcompiler privapp_data_file:file no_w_file_perms; |