Allow system_server to read apex_data_file. am: 9f343b32be am: 801e32ecc2
am: 5f7fc5fd41
Change-Id: Iff0fb59f0a8793f3f6aa652a3049720b1895ec4e
diff --git a/private/apexd.te b/private/apexd.te
index bed8953..4850d61 100644
--- a/private/apexd.te
+++ b/private/apexd.te
@@ -68,5 +68,5 @@
dontaudit apexd self:global_capability_class_set { dac_override dac_read_search };
neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms;
-neverallow { domain -apexd -init -kernel } apex_data_file:file no_rw_file_perms;
+neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms;
neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms;
diff --git a/private/system_server.te b/private/system_server.te
index 251c05a..5f36d9a 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -958,6 +958,13 @@
allow system_server apex_service:service_manager find;
allow system_server apexd:binder call;
+# Allow the system server to read files under /data/apex. The system_server
+# needs these privileges to compare file signatures while processing installs.
+#
+# Only apexd is allowed to create new entries or write to any file under /data/apex.
+allow system_server apex_data_file:dir search;
+allow system_server apex_data_file:file r_file_perms;
+
# dexoptanalyzer is currently used only for secondary dex files which
# system_server should never access.
neverallow system_server dexoptanalyzer_exec:file no_x_file_perms;