commit 79b4e1af4aa748a47bc2f9b524ab48160b451b75
author Oli Lan <olilan@google.com> Tue Nov 19 18:10:16 2019 +0000
committer Oli Lan <olilan@google.com> Mon Dec 09 11:14:38 2019 +0000
tree aa3c49006cf6e95c322e23d62c560c3a31e9a8f4
parent ecb84f87d84cda9f5fa0f5690ce2d694baefe31e

Add type for APEX data directories.

This adds a new apex_module_data_file type for the APEX data directories
under /data/misc/apexdata and /data/misc_[de|ce]/<u>/apexdata.

Permission is given for vold to identify which APEXes are present and
create the corresponding directories under apexdata in the ce/de user
directories.

See go/apex-data-directories.

Bug: 141148175
Test: Built & flashed, checked directories were created.
Change-Id: I95591e5fe85fc34f7ed21e2f4a75900ec2cfacfa

private/apexd.te

diff --git a/private/apexd.te b/private/apexd.te
index 31371d9..f752930 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -122,3 +122,6 @@
 neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms;
 neverallow { domain -apexd -init -kernel } apex_metadata_file:file no_w_file_perms;
 neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms;
+
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:dir no_w_dir_perms;
+neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:file no_w_file_perms;

private/compat/29.0/29.0.ignore.cil

diff --git a/private/compat/29.0/29.0.ignore.cil b/private/compat/29.0/29.0.ignore.cil
index eda155b..bfd6a2f 100644
--- a/private/compat/29.0/29.0.ignore.cil
+++ b/private/compat/29.0/29.0.ignore.cil
@@ -5,6 +5,7 @@
 (typeattribute new_objects)
 (typeattributeset new_objects
   ( new_objects
+    apex_module_data_file
     app_integrity_service
     app_search_service
     auth_service

private/file_contexts

diff --git a/private/file_contexts b/private/file_contexts
index 69b6c58..6ffbf10 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -495,6 +495,7 @@
 
 # Misc data
 /data/misc/adb(/.*)?            u:object_r:adb_keys_file:s0
+/data/misc/apexdata(/.*)?       u:object_r:apex_module_data_file:s0
 /data/misc/apns(/.*)?           u:object_r:radio_data_file:s0
 /data/misc/audio(/.*)?          u:object_r:audio_data_file:s0
 /data/misc/audioserver(/.*)?    u:object_r:audioserver_data_file:s0
@@ -578,6 +579,10 @@
 /data/misc_de/[0-9]+/rollback(/.*)?       u:object_r:rollback_data_file:s0
 /data/misc_ce/[0-9]+/rollback(/.*)?       u:object_r:rollback_data_file:s0
 
+# Apex data directories
+/data/misc_de/[0-9]+/apexdata(/.*)?       u:object_r:apex_module_data_file:s0
+/data/misc_ce/[0-9]+/apexdata(/.*)?       u:object_r:apex_module_data_file:s0
+
 #############################
 # Expanded data files
 #

private/vold_prepare_subdirs.te

diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te
index 348d3ce..51cc138 100644
--- a/private/vold_prepare_subdirs.te
+++ b/private/vold_prepare_subdirs.te
@@ -14,6 +14,7 @@
   vendor_data_file
 }:dir { open read write add_name remove_name rmdir relabelfrom };
 allow vold_prepare_subdirs {
+    apex_module_data_file
     backup_data_file
     face_vendor_data_file
     fingerprint_vendor_data_file
@@ -23,6 +24,7 @@
     vold_data_file
 }:dir { create_dir_perms relabelto };
 allow vold_prepare_subdirs {
+    apex_module_data_file
     backup_data_file
     face_vendor_data_file
     fingerprint_vendor_data_file
@@ -32,5 +34,6 @@
     system_data_file
     vold_data_file
 }:file { getattr unlink };
+allow vold_prepare_subdirs apex_mnt_dir:dir { open read };
 
 dontaudit vold_prepare_subdirs { proc unlabeled }:file r_file_perms;