Enable odrefresh to work with composd.
composd spawns odrefresh in its usual domain. odrefresh then spawns
fd_server in a different domain, and makes binder calls back to
composd to perform individual compilation steps.
fd_server is fairly generic, and part of the virt APEX, but this
instance is specific to composd (e.g. it has access to ART files), so
I named the domain composd_fd_server.
Bug: 186126194
Test: Run composd_cmd, artifacts generated
Change-Id: I5a431dd00b5b396a67021c618fc6edcfb25aa21b
diff --git a/private/odrefresh.te b/private/odrefresh.te
index 811b7cf..c6ab7bb 100644
--- a/private/odrefresh.te
+++ b/private/odrefresh.te
@@ -49,9 +49,20 @@
# odrefesh.
allow odrefresh composd:fd use;
-# Run system binaries, e.g. pvm_exec, in the same domain
+# Run binaries from the CompOS APEX in the same domain
allow odrefresh system_file:file execute_no_trans;
+# Make binder calls back to composd
+binder_use(odrefresh)
+allow odrefresh compos_service:service_manager find;
+binder_call(odrefresh, composd)
+
+# Run fd_server in its own domain
+domain_auto_trans(odrefresh, fd_server_exec, compos_fd_server)
+
+# And kill it via SIGTERM
+allow odrefresh compos_fd_server:process signal;
+
# Do not audit unused resources from parent processes (adb, shell, su).
# These appear to be unnecessary for odrefresh.
dontaudit odrefresh { adbd shell }:fd use;