Allow compsvc to execute odrefresh
Bug: 205750213
Test: /apex/com.android.compos/bin/composd_cmd forced-odrefresh
# With SELinux enforced in the VM, plus some hacks in ART,
# observed odrefresh exited 80.
Change-Id: I81ab0a73314fdcea69c69350c792ff7acab5aab8
diff --git a/microdroid/system/private/compos.te b/microdroid/system/private/compos.te
index b8ad335..7866b20 100644
--- a/microdroid/system/private/compos.te
+++ b/microdroid/system/private/compos.te
@@ -28,5 +28,13 @@
# metadata. See b/196635431.
allow compos authfs_fuse:file getattr;
-# Allow domain transition into dex2oat.
+# Allow creating the odrefresh output directory in authfs.
+allow compos authfs_fuse:dir create_dir_perms;
+
+# Allow locating the authfs mount directory.
+allow compos authfs_data_file:dir { search };
+
+# Allow domain transition into odrefresh and dex2oat.
+# TODO(b/209008712): Remove dex2oat once the migration is done.
+domain_auto_trans(compos, odrefresh_exec, odrefresh)
domain_auto_trans(compos, dex2oat_exec, dex2oat)
diff --git a/microdroid/system/private/dex2oat.te b/microdroid/system/private/dex2oat.te
index bf44251..0f8b905 100644
--- a/microdroid/system/private/dex2oat.te
+++ b/microdroid/system/private/dex2oat.te
@@ -7,6 +7,7 @@
# Allow dex2oat to use FDs from authfs_service via compos.
allow dex2oat authfs_service:fd use;
allow dex2oat compos:fd use;
+allow dex2oat odrefresh:fd use;
# Allow dex2oat to read/write FDs on authfs_fuse filesystem.
allow dex2oat authfs_fuse:file { read write getattr map };
diff --git a/microdroid/system/private/odrefresh.te b/microdroid/system/private/odrefresh.te
new file mode 100644
index 0000000..3dd2d2c
--- /dev/null
+++ b/microdroid/system/private/odrefresh.te
@@ -0,0 +1,23 @@
+# odrefresh
+type odrefresh, domain, coredomain;
+type odrefresh_exec, system_file_type, exec_type, file_type;
+
+# Run dex2oat in its own sandbox.
+domain_auto_trans(odrefresh, dex2oat_exec, dex2oat)
+
+# Allow odrefresh to kill dex2oat if compilation times out.
+allow odrefresh dex2oat:process sigkill;
+
+# Allow odrefresh to read/write/lookup files/directories on authfs.
+allow odrefresh authfs_fuse:file create_file_perms;
+allow odrefresh authfs_fuse:dir create_dir_perms;
+
+# Allow odrefresh to check the parent directory exists.
+allow odrefresh authfs_data_file:dir { search getattr };
+
+# Allow odrefresh to read /apex/apex-info-list.xml to gather information of
+# the current APEXes.
+allow odrefresh apex_info_file:file r_file_perms;
+
+# Do not audit unused resources from parent processes.
+dontaudit odrefresh compos:fd use;