commit 37f1a137b673bb963a5bd65cde8b0ca81fd366c7
author Suren Baghdasaryan <surenb@google.com> Fri Nov 20 18:57:36 2020 -0800
committer Suren Baghdasaryan <surenb@google.com> Mon Nov 23 09:30:26 2020 -0800
tree 53bb3231c36c3dbea7f4f06c291aa2b4c616decd
parent a2028972db9849a82488fe2748dd4971cc4a4920

Add rules for per-API level task profiles and cgroup description files

Define access rights to new per-API level task profiles and cgroup
description files under /etc/task_profiles/.

Bug: 172066799
Test: boot with per-API task profiles
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I04c9929fdffe33a9fc82d431a53f47630f9dcfc3

private/compat/30.0/30.0.ignore.cil

diff --git a/private/compat/30.0/30.0.ignore.cil b/private/compat/30.0/30.0.ignore.cil
index f89f2e2..78b7929 100644
--- a/private/compat/30.0/30.0.ignore.cil
+++ b/private/compat/30.0/30.0.ignore.cil
@@ -8,6 +8,7 @@
     ab_update_gki_prop
     adbd_config_prop
     apex_info_file
+    cgroup_desc_api_file
     cgroup_v2
     ctl_snapuserd_prop
     debugfs_kprobes
@@ -46,6 +47,7 @@
     sysfs_devices_cs_etm
     system_server_dumper_service
     system_suspend_control_internal_service
+    task_profiles_api_file
     update_engine_stable_service
     userspace_reboot_metadata_file
     vcn_management_service

private/domain.te

diff --git a/private/domain.te b/private/domain.te
index 6cf102f..84fa107 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -57,6 +57,7 @@
 allow domain cgroup_rc_file:dir search;
 allow domain cgroup_rc_file:file r_file_perms;
 allow domain task_profiles_file:file r_file_perms;
+allow domain task_profiles_api_file:file r_file_perms;
 allow domain vendor_task_profiles_file:file r_file_perms;
 
 # Allow all domains to read sys.use_memfd to determine

private/file_contexts

diff --git a/private/file_contexts b/private/file_contexts
index 7f8aef3..d39b349 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -322,6 +322,7 @@
 /system/bin/hw/android\.hidl\.allocator@1\.0-service          u:object_r:hal_allocator_default_exec:s0
 /system/bin/hw/android\.system\.suspend@1\.0-service          u:object_r:system_suspend_exec:s0
 /system/etc/cgroups\.json               u:object_r:cgroup_desc_file:s0
+/system/etc/task_profiles/cgroups_[0-9]+\.json               u:object_r:cgroup_desc_api_file:s0
 /system/etc/event-log-tags              u:object_r:system_event_log_tags_file:s0
 /system/etc/group                       u:object_r:system_group_file:s0
 /system/etc/ld\.config.*                u:object_r:system_linker_config_file:s0
@@ -339,6 +340,7 @@
 /system/etc/selinux/plat_sepolicy\.cil       u:object_r:sepolicy_file:s0
 /system/etc/selinux/plat_and_mapping_sepolicy\.cil\.sha256 u:object_r:sepolicy_file:s0
 /system/etc/task_profiles\.json  u:object_r:task_profiles_file:s0
+/system/etc/task_profiles/task_profiles_[0-9]+\.json  u:object_r:task_profiles_api_file:s0
 /system/usr/share/zoneinfo(/.*)? u:object_r:system_zoneinfo_file:s0
 /system/bin/vr_hwc               u:object_r:vr_hwc_exec:s0
 /system/bin/adbd                 u:object_r:adbd_exec:s0