Merge "Remove unused /selinux_version"
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 2f8066a..15ab764 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -97,3 +97,6 @@
# Avoid reads from generically labeled /proc files
# Create a more specific label if needed
neverallow all_untrusted_apps proc:file { no_rw_file_perms no_x_file_perms };
+
+# Do not allow untrusted apps access to preloads data files
+neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms;
diff --git a/private/file_contexts b/private/file_contexts
index 03ab637..2f009ac 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -291,6 +291,8 @@
/data/nativetest64(/.*)? u:object_r:nativetest_data_file:s0
/data/property(/.*)? u:object_r:property_data_file:s0
/data/preloads(/.*)? u:object_r:preloads_data_file:s0
+/data/preloads/media(/.*)? u:object_r:preloads_media_file:s0
+/data/preloads/demo(/.*)? u:object_r:preloads_media_file:s0
# Misc data
/data/misc/adb(/.*)? u:object_r:adb_keys_file:s0
diff --git a/private/platform_app.te b/private/platform_app.te
index 2817e5a..6b18d8f 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -56,5 +56,7 @@
# Access to /data/preloads
allow platform_app preloads_data_file:file r_file_perms;
allow platform_app preloads_data_file:dir r_dir_perms;
+allow platform_app preloads_media_file:file r_file_perms;
+allow platform_app preloads_media_file:dir r_dir_perms;
read_runtime_log_tags(platform_app)
diff --git a/private/priv_app.te b/private/priv_app.te
index 76dbb98..83a4b3f 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -96,6 +96,8 @@
# Access to /data/preloads
allow priv_app preloads_data_file:file r_file_perms;
allow priv_app preloads_data_file:dir r_dir_perms;
+allow priv_app preloads_media_file:file r_file_perms;
+allow priv_app preloads_media_file:dir r_dir_perms;
# TODO: revert this as part of fixing 33574909
# android.process.media uses /dev/mtp_usb
diff --git a/private/system_server.te b/private/system_server.te
index d78c576..f25e8ce 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -599,6 +599,8 @@
# Access to /data/preloads
allow system_server preloads_data_file:file { r_file_perms unlink };
allow system_server preloads_data_file:dir { r_dir_perms write remove_name rmdir };
+allow system_server preloads_media_file:file { r_file_perms unlink };
+allow system_server preloads_media_file:dir { r_dir_perms write remove_name rmdir };
r_dir_file(system_server, cgroup)
allow system_server ion_device:chr_file r_file_perms;
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index 6534412..993b3d0 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -88,6 +88,7 @@
allow untrusted_app_all sysfs_hwrandom:dir search;
allow untrusted_app_all sysfs_hwrandom:file r_file_perms;
-# Allow apps to view preloaded content
-allow untrusted_app_all preloads_data_file:dir r_dir_perms;
-allow untrusted_app_all preloads_data_file:file r_file_perms;
+# Allow apps to view preloaded media content
+allow untrusted_app_all preloads_media_file:dir r_dir_perms;
+allow untrusted_app_all preloads_media_file:file r_file_perms;
+allow untrusted_app_all preloads_data_file:dir search;
diff --git a/public/file.te b/public/file.te
index 2936d65..5b99344 100644
--- a/public/file.te
+++ b/public/file.te
@@ -132,6 +132,8 @@
type ringtone_file, file_type, data_file_type, mlstrustedobject;
# /data/preloads
type preloads_data_file, file_type, data_file_type;
+# /data/preloads/media
+type preloads_media_file, file_type, data_file_type;
# Mount locations managed by vold
type mnt_media_rw_file, file_type;
diff --git a/public/installd.te b/public/installd.te
index 5e0ccc4..0a5b8a3 100644
--- a/public/installd.te
+++ b/public/installd.te
@@ -132,6 +132,8 @@
# TODO b/34690396 Remove when time-based purge policy for preloads is implemented in system_server
allow installd preloads_data_file:file { r_file_perms unlink };
allow installd preloads_data_file:dir { r_dir_perms write remove_name rmdir };
+allow installd preloads_media_file:file { r_file_perms unlink };
+allow installd preloads_media_file:dir { r_dir_perms write remove_name rmdir };
###
### Neverallow rules
diff --git a/public/mediaserver.te b/public/mediaserver.te
index 6b3f051..a641bf7 100644
--- a/public/mediaserver.te
+++ b/public/mediaserver.te
@@ -124,8 +124,8 @@
allow mediaserver media_rw_data_file:dir create_dir_perms;
allow mediaserver media_rw_data_file:file create_file_perms;
-# Access to /data/preloads
-allow mediaserver preloads_data_file:file { getattr read ioctl };
+# Access to media in /data/preloads
+allow mediaserver preloads_media_file:file { getattr read ioctl };
allow mediaserver ion_device:chr_file r_file_perms;
allow mediaserver hal_graphics_allocator:fd use;