1type migrate_legacy_obb_data, domain, coredomain; 2type migrate_legacy_obb_data_exec, system_file_type, exec_type, file_type; 3 4allow migrate_legacy_obb_data media_rw_data_file:dir create_dir_perms; 5allow migrate_legacy_obb_data media_rw_data_file:file create_file_perms; 6 7allow migrate_legacy_obb_data shell_exec:file rx_file_perms; 8 9allow migrate_legacy_obb_data toolbox_exec:file rx_file_perms; 10 11allow migrate_legacy_obb_data self:capability { chown dac_override dac_read_search fowner fsetid }; 12 13allow migrate_legacy_obb_data mnt_user_file:dir search; 14allow migrate_legacy_obb_data mnt_user_file:lnk_file read; 15allow migrate_legacy_obb_data storage_file:dir search; 16allow migrate_legacy_obb_data storage_file:lnk_file read; 17 18allow migrate_legacy_obb_data sdcard_type:dir create_dir_perms; 19allow migrate_legacy_obb_data sdcard_type:file create_file_perms; 20 21# TODO: This should not be necessary. We don't deliberately hand over 22# any open file descriptors to this domain, so anything that triggers this 23# should be a candidate for O_CLOEXEC. 24allow migrate_legacy_obb_data installd:fd use; 25 26# This rule is required to let this process read /proc/{parent_pid}/mount. 27# TODO: Why is this required ? 28allow migrate_legacy_obb_data installd:file read; 29