commit b238fe666212ce86fe3fe1521e9692a361a53047
author Fyodor Kupolov <fkupolov@google.com> Tue Mar 14 11:42:03 2017 -0700
committer Fyodor Kupolov <fkupolov@google.com> Wed Mar 15 00:49:37 2017 +0000
tree 01eff8e974e399a8ab9812f383bf98bc4b4fbfd7
parent 41518bec2508c85eb8797980321d3912b4598261

Split preloads into media_file and data_file

Untrusted apps should only access /data/preloads/media and demo directory.

Bug: 36197686
Test: Verified retail mode.
      Checked non-privileged APK cannot access /data/preloads
Change-Id: I8e9c21ff6aba799aa31bf06893cdf60dafc04446

private/priv_app.te

diff --git a/private/priv_app.te b/private/priv_app.te
index 76dbb98..83a4b3f 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -96,6 +96,8 @@
 # Access to /data/preloads
 allow priv_app preloads_data_file:file r_file_perms;
 allow priv_app preloads_data_file:dir r_dir_perms;
+allow priv_app preloads_media_file:file r_file_perms;
+allow priv_app preloads_media_file:dir r_dir_perms;
 
 # TODO: revert this as part of fixing 33574909
 # android.process.media uses /dev/mtp_usb