Allow composd to delete odrefresh target files
We need to remove any existing files (and the directory) to allow
odrefresh in the VM to re-create them via authfs.
But we don't need, and shouldn't have, any other access to them.
Bug: 210460516
Test: composd_cmd async-odrefresh
Change-Id: Iaafe33934146a6b8dda7c28cc1239c2eed167379
diff --git a/private/composd.te b/private/composd.te
index 88c4e4a..5b8f586 100644
--- a/private/composd.te
+++ b/private/composd.te
@@ -13,16 +13,19 @@
# Start a VM
virtualizationservice_use(composd)
-# Allow preparing staging directory for odrefresh
+# Prepare staging directory for odrefresh
allow composd apex_art_data_file:dir { create_dir_perms relabelfrom };
allow composd apex_art_staging_data_file:dir { create_dir_perms relabelto };
+# Delete files in the odrefresh target directory
+allow composd apex_art_data_file:file unlink;
+
# Access our APEX data files
allow composd apex_module_data_file:dir search;
allow composd apex_compos_data_file:dir create_dir_perms;
allow composd apex_compos_data_file:file create_file_perms;
-# TODO(b/209008712): Removed these when we run odrefresh in the VM
+# TODO(b/209008712): Remove these when we run odrefresh in the VM
# Run odrefresh to refresh ART artifacts, and kill it if we need to
domain_auto_trans(composd, odrefresh_exec, odrefresh)
allow composd odrefresh:process sigkill;
@@ -33,3 +36,6 @@
# Read ART's properties
get_prop(composd, dalvik_config_prop)
+
+# We never create any artifact files directly
+neverallow composd apex_art_data_file:file ~unlink;
diff --git a/private/domain.te b/private/domain.te
index ba26ddf..d12cbc7 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -304,7 +304,8 @@
# contains boot class path and system server AOT artifacts following an ART APEX Mainline update.
neverallow {
domain
- # art processes
+ # art-related processes
+ -composd
-compos_fd_server
-odrefresh
-odsign
@@ -317,10 +318,10 @@
neverallow {
domain
# art-related processes
+ -composd
-compos_fd_server
-odrefresh
-odsign
- -composd # TODO: Remove
# others
-apexd
-init