2nd attempt in fixing sepolicy for shell+oatdump
aosp/2876742 changed the file context of oatdump from system_file to
oatdump_exec, which broke shell access on older platform versions. This
change fixes the issue by changing the file context back to system_file.
Also grant uprobestats rx_file_perms to system_file so it can execute
oatdump.
For now retain the label oatdump_exec to avoid build breakage.
b/352184398. The label will be removed once it's safe to do so.
Bug: 350628688
Test: m hello_uprobestats && hello_uprobestats
Change-Id: Ic34c2b7d70ce4f602a4d2cd223b5a86ee23f9b0e
diff --git a/private/file.te b/private/file.te
index f8a48cd..d30465b 100644
--- a/private/file.te
+++ b/private/file.te
@@ -38,6 +38,7 @@
type uprobestats_configs_data_file, file_type, data_file_type, core_data_file_type;
# /apex/com.android.art/bin/oatdump
+# TODO (b/350628688): Remove this once it's safe to do so.
type oatdump_exec, system_file_type, exec_type, file_type;
# /data/misc_{ce/de}/<user>/sdksandbox root data directory for sdk sandbox processes
diff --git a/private/shell.te b/private/shell.te
index d613a94..6d6e06f 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -262,6 +262,7 @@
get_prop(shell, build_attestation_prop)
# Allow shell to execute oatdump.
+# TODO (b/350628688): Remove this once it's safe to do so.
allow shell oatdump_exec:file rx_file_perms;
# Allow shell access to socket for test
diff --git a/private/uprobestats.te b/private/uprobestats.te
index f6dd906..2c5711f 100644
--- a/private/uprobestats.te
+++ b/private/uprobestats.te
@@ -16,7 +16,7 @@
allow uprobestats sysfs_uprobe:dir { search };
# Allow uprobestats to popen oatdump.
-allow uprobestats oatdump_exec:file rx_file_perms;
+allow uprobestats system_file:file rx_file_perms;
# Allow uprobestats to write atoms to statsd
unix_socket_send(uprobestats, statsdw, statsd)