Revert "Remove legacy execmod access."
This reverts commit 0f11ffccf907b000213d76eccb22a84ac73c19e5.
Reason for revert: libmono crashes
Bug: 112292089
Bug: 111544476
Test: policy compiles, device boots
Change-Id: I064090aa9337cf17b80cd2c9af9342df851a3b27
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index fdda730..6ec2183 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -20,9 +20,13 @@
### Note that rules that should apply to all untrusted apps must be in app.te or also
### added to ephemeral_app.te.
+# Legacy text relocations
+allow untrusted_app_all apk_data_file:file execmod;
+
# Some apps ship with shared libraries and binaries that they write out
# to their sandbox directory and then execute.
allow untrusted_app_all { app_data_file privapp_data_file }:file { rx_file_perms };
+allow untrusted_app_all app_data_file:file execmod;
# Executing files from an application home directory violates
# W^X (https://en.wikipedia.org/wiki/W%5EX) constraints (loading executable code
@@ -34,7 +38,7 @@
allow untrusted_app_all asec_apk_file:file r_file_perms;
allow untrusted_app_all asec_apk_file:dir r_dir_perms;
# Execute libs in asec containers.
-allow untrusted_app_all asec_public_file:file { execute };
+allow untrusted_app_all asec_public_file:file { execute execmod };
# Used by Finsky / Android "Verify Apps" functionality when
# running "adb install foo.apk".
@@ -153,6 +157,10 @@
}:{ dir file lnk_file } { getattr open read };
')
+# Temporary auditing to get data on what apps use execmod.
+# TODO(b/111544476) Remove this and deny the permission if feasible.
+auditallow untrusted_app_all { apk_data_file app_data_file asec_public_file }:file execmod;
+
# Attempts to write to system_data_file is generally a sign
# that apps are attempting to access encrypted storage before
# the ACTION_USER_UNLOCKED intent is delivered. Suppress this