Merge "Allow system app to find NearbyManager"
diff --git a/build/soong/Android.bp b/build/soong/Android.bp
index ea11e1f..8518d4d 100644
--- a/build/soong/Android.bp
+++ b/build/soong/Android.bp
@@ -36,11 +36,11 @@
"cil_compat_map.go",
"compat_cil.go",
"filegroup.go",
- "neverallow_test.go",
"policy.go",
"selinux.go",
"selinux_contexts.go",
"sepolicy_freeze.go",
+ "sepolicy_neverallow.go",
"sepolicy_vers.go",
"versioned_policy.go",
],
diff --git a/build/soong/neverallow_test.go b/build/soong/sepolicy_neverallow.go
similarity index 100%
rename from build/soong/neverallow_test.go
rename to build/soong/sepolicy_neverallow.go
diff --git a/microdroid/system/private/compos.te b/microdroid/system/private/compos.te
index cbf09ad..174eda3 100644
--- a/microdroid/system/private/compos.te
+++ b/microdroid/system/private/compos.te
@@ -26,6 +26,14 @@
# Allow locating the authfs mount directory.
allow compos authfs_data_file:dir search;
+# Run derive_classpath in our domain
+allow compos derive_classpath_exec:file rx_file_perms;
+allow compos apex_mnt_dir:dir r_dir_perms;
+# Ignore harmless denials on /proc/self/fd
+dontaudit compos self:dir write;
+# See b/35323867#comment3
+dontaudit compos self:global_capability_class_set dac_override;
+
# Allow domain transition into odrefresh and dex2oat.
# TODO(b/209008712): Remove dex2oat once the migration is done.
domain_auto_trans(compos, odrefresh_exec, odrefresh)
diff --git a/microdroid/system/private/derive_classpath.te b/microdroid/system/private/derive_classpath.te
new file mode 100644
index 0000000..e439692
--- /dev/null
+++ b/microdroid/system/private/derive_classpath.te
@@ -0,0 +1 @@
+type derive_classpath_exec, system_file_type, exec_type, file_type;
diff --git a/private/bootanim.te b/private/bootanim.te
index 855bc3d..f4fb0bc 100644
--- a/private/bootanim.te
+++ b/private/bootanim.te
@@ -15,3 +15,6 @@
# Allow updating boot animation status.
set_prop(bootanim, bootanim_system_prop)
+
+# Allow accessing /data/bootanim
+r_dir_file(bootanim, bootanim_data_file)
diff --git a/private/file.te b/private/file.te
index 0eb2018..5b6170f 100644
--- a/private/file.te
+++ b/private/file.te
@@ -69,6 +69,9 @@
# /data/system/environ
type environ_system_data_file, file_type, data_file_type, core_data_file_type;
+# /data/bootanim
+type bootanim_data_file, file_type, data_file_type, core_data_file_type;
+
# /dev/kvm
type kvm_device, dev_type;
diff --git a/private/file_contexts b/private/file_contexts
index 41bc184..4a04532 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -704,6 +704,8 @@
/data/incremental/MT_[^/]+/mount/.log u:object_r:incremental_control_file:s0
/data/incremental/MT_[^/]+/mount/.blocks_written u:object_r:incremental_control_file:s0
+# Boot animation data
+/data/bootanim(/.*)? u:object_r:bootanim_data_file:s0
#############################
# Expanded data files
#
diff --git a/private/service.te b/private/service.te
index c3bbd0d..10461ec 100644
--- a/private/service.te
+++ b/private/service.te
@@ -2,7 +2,7 @@
type compos_service, service_manager_type;
type dynamic_system_service, system_api_service, system_server_service, service_manager_type;
type gsi_service, service_manager_type;
-type incidentcompanion_service, system_api_service, system_server_service, service_manager_type;
+type incidentcompanion_service, app_api_service, system_api_service, system_server_service, service_manager_type;
type mediatuner_service, app_api_service, service_manager_type;
type profcollectd_service, service_manager_type;
type resolver_service, system_server_service, service_manager_type;