Merge "Allow compos_fd_server to create artifacts"
diff --git a/private/compos_fd_server.te b/private/compos_fd_server.te
index 72964c3..a1a8a64 100644
--- a/private/compos_fd_server.te
+++ b/private/compos_fd_server.te
@@ -4,15 +4,18 @@
# Allow access to open fds inherited from odrefresh - read inputs, generate outputs
# TODO(b/209008712): Remove once migration is done.
allow compos_fd_server odrefresh:fd use;
-allow compos_fd_server apex_art_data_file:file { getattr read };
# Allow access to open fds inherited from composd
allow compos_fd_server composd:fd use;
-# Allow creating new files and directory in the staging directory.
+# Allow creating new files and directories in the staging directory.
allow compos_fd_server apex_art_staging_data_file:dir create_dir_perms;
allow compos_fd_server apex_art_staging_data_file:file create_file_perms;
+# Allow creating new files and directories in the artifacts directory.
+allow compos_fd_server apex_art_data_file:dir create_dir_perms;
+allow compos_fd_server apex_art_data_file:file create_file_perms;
+
# Use a pipe to signal readiness
# TODO(b/205750213): Removed odrefresh when we run odrefresh in the VM
allow compos_fd_server odrefresh:fifo_file write;
diff --git a/private/domain.te b/private/domain.te
index 24e05b5..ba26ddf 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -305,6 +305,7 @@
neverallow {
domain
# art processes
+ -compos_fd_server
-odrefresh
-odsign
# others
@@ -316,9 +317,10 @@
neverallow {
domain
# art-related processes
+ -compos_fd_server
-odrefresh
-odsign
- -composd
+ -composd # TODO: Remove
# others
-apexd
-init