rootdir/etc/ld.config.legacy.txt

# Copyright (C) 2017 The Android Open Source Project
#
# Bionic loader config file.
# This gives the exactly the same namespace setup in pre-O.
#

# All binaries gets the same configuration 'legacy'
dir.legacy = /system
dir.legacy = /product
dir.legacy = /vendor
dir.legacy = /odm
dir.legacy = /sbin

# Except for /postinstall, where only /system and /product are searched
dir.postinstall = /postinstall

[legacy]
namespace.default.isolated = false

namespace.default.search.paths  = /system/${LIB}
namespace.default.search.paths += /product/${LIB}
namespace.default.search.paths += /vendor/${LIB}
namespace.default.search.paths += /odm/${LIB}

namespace.default.asan.search.paths  = /data/asan/system/${LIB}
namespace.default.asan.search.paths +=           /system/${LIB}
namespace.default.asan.search.paths += /data/asan/product/${LIB}
namespace.default.asan.search.paths +=           /product/${LIB}
namespace.default.asan.search.paths += /data/asan/vendor/${LIB}
namespace.default.asan.search.paths +=           /vendor/${LIB}
namespace.default.asan.search.paths += /data/asan/odm/${LIB}
namespace.default.asan.search.paths +=           /odm/${LIB}

###############################################################################
# APEX related namespaces.
###############################################################################

additional.namespaces = runtime,conscrypt,media
namespace.default.asan.permitted.paths += /apex/com.android.resolv/${LIB}

# Keep in sync with ld.config.txt in the com.android.runtime APEX.
namespace.default.links = runtime
namespace.default.asan.links = runtime
# Visible because some libraries are dlopen'ed, e.g. libopenjdk is dlopen'ed by
# libart.
namespace.default.visible = true
namespace.default.link.runtime.shared_libs  = libart.so:libartd.so
namespace.default.link.runtime.shared_libs += libdexfile_external.so
namespace.default.link.runtime.shared_libs += libnativebridge.so
namespace.default.link.runtime.shared_libs += libnativehelper.so
namespace.default.link.runtime.shared_libs += libnativeloader.so

###############################################################################
# "runtime" APEX namespace
#
# This namespace exposes externally accessible libraries from the Runtime APEX.
###############################################################################
namespace.runtime.isolated = true

# Keep in sync with ld.config.txt in the com.android.runtime APEX.
namespace.runtime.search.paths = /apex/com.android.runtime/${LIB}
namespace.runtime.asan.search.paths = /apex/com.android.runtime/${LIB}
namespace.runtime.links = default
# TODO(b/119867084): Restrict to Bionic dlopen dependencies and PALette library
# when it exists.
namespace.runtime.link.default.allow_all_shared_libs = true

###############################################################################
# "media" APEX namespace
#
# This namespace is for libraries within the media APEX.
###############################################################################
namespace.media.isolated = true
namespace.media.visible = true

namespace.media.search.paths = /apex/com.android.media/${LIB}
namespace.media.asan.search.paths = /apex/com.android.media/${LIB}

namespace.media.links = default
namespace.media.link.default.shared_libs  = %LLNDK_LIBRARIES%
namespace.media.link.default.shared_libs += libandroid.so
namespace.media.link.default.shared_libs += libbinder_ndk.so
namespace.media.link.default.shared_libs += %SANITIZER_RUNTIME_LIBRARIES%

###############################################################################
# "conscrypt" APEX namespace
#
# This namespace is for libraries within the conscrypt APEX.
###############################################################################
namespace.conscrypt.isolated = true
namespace.conscrypt.visible = true

# Keep in sync with ld.config.txt in the com.android.runtime APEX.
namespace.conscrypt.search.paths = /apex/com.android.conscrypt/${LIB}
namespace.conscrypt.asan.search.paths = /apex/com.android.conscrypt/${LIB}
namespace.conscrypt.links = default
namespace.conscrypt.link.default.shared_libs  = libc.so
namespace.conscrypt.link.default.shared_libs += libm.so
namespace.conscrypt.link.default.shared_libs += libdl.so

###############################################################################
# Namespace config for binaries under /postinstall.
# Only one default namespace is defined and it has no directories other than
# /system/lib and /product/lib in the search paths. This is because linker
# calls realpath on the search paths and this causes selinux denial if the
# paths (/vendor, /odm) are not allowed to the poinstall binaries.
# There is no reason to allow the binaries to access the paths.
###############################################################################
[postinstall]
namespace.default.isolated = false
namespace.default.search.paths  = /system/${LIB}
namespace.default.search.paths += /product/${LIB}