Inseob Kim | ff43be2 | 2021-06-07 16:56:56 +0900 | [diff] [blame] | 1 | # cppreopts |
| 2 | # |
| 3 | # This command copies preopted files from the system_b partition to the data |
| 4 | # partition. This domain ensures that we are only copying into specific |
| 5 | # directories. |
| 6 | |
| 7 | type cppreopts, domain, mlstrustedsubject, coredomain; |
| 8 | type cppreopts_exec, system_file_type, exec_type, file_type; |
| 9 | |
| 10 | # Technically not a daemon but we do want the transition from init domain to |
| 11 | # cppreopts to occur. |
| 12 | init_daemon_domain(cppreopts) |
| 13 | domain_auto_trans(cppreopts, preopt2cachename_exec, preopt2cachename); |
| 14 | |
| 15 | # Allow cppreopts copy files into the dalvik-cache |
| 16 | allow cppreopts dalvikcache_data_file:dir { add_name remove_name search write }; |
| 17 | allow cppreopts dalvikcache_data_file:file { create getattr open read rename write unlink }; |
| 18 | |
| 19 | # Allow cppreopts to execute itself using #!/system/bin/sh |
| 20 | allow cppreopts shell_exec:file rx_file_perms; |
| 21 | |
| 22 | # Allow us to run find on /postinstall |
| 23 | allow cppreopts system_file:dir { open read }; |
| 24 | |
| 25 | # Allow running the cp command using cppreopts permissions. Needed so we can |
| 26 | # write into dalvik-cache |
| 27 | allow cppreopts toolbox_exec:file rx_file_perms; |
| 28 | |
| 29 | # Silence the denial when /postinstall cannot be mounted, e.g., system_other |
| 30 | # is wiped, but cppreopts.sh still runs. |
| 31 | dontaudit cppreopts postinstall_mnt_dir:dir search; |