| Nick Kralevich | caf42d6 | 2018-10-04 10:57:29 -0700 | [diff] [blame] | 1 | type system_server_startup, domain, coredomain; |
| Jeff Vander Stoep | 41a2abf | 2019-01-23 15:07:40 -0800 | [diff] [blame] | 2 | type system_server_startup_tmpfs, file_type; |
| Nick Kralevich | caf42d6 | 2018-10-04 10:57:29 -0700 | [diff] [blame] | 3 | |
| 4 | tmpfs_domain(system_server_startup) |
| 5 | |
| 6 | # Create JIT memory |
| 7 | allow system_server_startup self:process execmem; |
| 8 | allow system_server_startup system_server_startup_tmpfs:file { execute read write open map }; |
| 9 | |
| Orion Hodson | 7778e8c | 2021-06-23 16:41:14 +0100 | [diff] [blame^] | 10 | # Allow to pick up integrity-checked artifacts from the ART APEX dalvik cache. |
| 11 | allow system_server_startup apex_art_data_file:dir r_dir_perms; |
| 12 | allow system_server_startup apex_art_data_file:file { r_file_perms execute }; |
| 13 | |
| Nick Kralevich | caf42d6 | 2018-10-04 10:57:29 -0700 | [diff] [blame] | 14 | # Allow system_server_startup to run setcon() and enter the |
| 15 | # system_server domain |
| 16 | allow system_server_startup self:process setcurrent; |
| 17 | allow system_server_startup system_server:process dyntransition; |
| Jeff Vander Stoep | 67dc274 | 2019-04-04 09:25:15 -0700 | [diff] [blame] | 18 | |
| 19 | # Child of the zygote. |
| 20 | allow system_server_startup zygote:process sigchld; |
| Calin Juravle | cf6a7e9 | 2021-06-03 08:16:22 -0700 | [diff] [blame] | 21 | |
| 22 | # Allow query ART device config properties |
| 23 | get_prop(system_server_startup, device_config_runtime_native_boot_prop) |
| 24 | get_prop(system_server_startup, device_config_runtime_native_prop) |