1# otapreopt_chroot executable 2type otapreopt_chroot, domain, coredomain; 3type otapreopt_chroot_exec, system_file_type, exec_type, file_type; 4 5# Chroot preparation and execution. 6# We need to create an unshared mount namespace, and then mount /data. 7allow otapreopt_chroot postinstall_file:dir { search mounton }; 8allow otapreopt_chroot self:global_capability_class_set { sys_admin sys_chroot }; 9 10# This is required to mount /vendor and mount/unmount ext4 images from 11# APEX packages in /postinstall/apex. 12allow otapreopt_chroot block_device:dir search; 13allow otapreopt_chroot labeledfs:filesystem { mount unmount }; 14# This is required for dynamic partitions. 15allow otapreopt_chroot dm_device:chr_file rw_file_perms; 16 17# This is required to unmount flattened APEX packages under 18# /postinstall/system/apex (which are bind-mounted in /postinstall/apex). 19allow otapreopt_chroot postinstall_file:filesystem unmount; 20# Mounting /vendor can have this side-effect. Ignore denial. 21dontaudit otapreopt_chroot kernel:process setsched; 22 23# Allow otapreopt_chroot to read SELinux policy files. 24allow otapreopt_chroot file_contexts_file:file r_file_perms; 25 26# Allow otapreopt_chroot to open and read the contents of /postinstall/system/apex. 27allow otapreopt_chroot postinstall_file:dir r_dir_perms; 28# Allow otapreopt_chroot to read the persist.apexd.verity_on_system system property. 29get_prop(otapreopt_chroot, apexd_prop) 30 31# Allow otapreopt to use file descriptors from update-engine. It will 32# close them immediately. 33allow otapreopt_chroot postinstall:fd use; 34allow otapreopt_chroot update_engine:fd use; 35allow otapreopt_chroot update_engine:fifo_file write; 36 37# Allow to transition to postinstall_dexopt, to run otapreopt in its own sandbox. 38domain_auto_trans(otapreopt_chroot, postinstall_file, postinstall_dexopt) 39 40# Allow otapreopt_chroot to create loop devices with /dev/loop-control. 41allow otapreopt_chroot loop_control_device:chr_file rw_file_perms; 42# Allow otapreopt_chroot to access loop devices. 43allow otapreopt_chroot loop_device:blk_file rw_file_perms; 44allowxperm otapreopt_chroot loop_device:blk_file ioctl { 45 LOOP_GET_STATUS64 46 LOOP_SET_STATUS64 47 LOOP_SET_FD 48 LOOP_SET_BLOCK_SIZE 49 LOOP_SET_DIRECT_IO 50 LOOP_CLR_FD 51 BLKFLSBUF 52}; 53 54# Allow otapreopt_chroot to configure read-ahead of loop devices. 55allow otapreopt_chroot sysfs_loop:dir r_dir_perms; 56allow otapreopt_chroot sysfs_loop:file rw_file_perms; 57 58# Allow otapreopt_chroot to mount a tmpfs filesystem in /postinstall/apex. 59allow otapreopt_chroot tmpfs:filesystem mount; 60# Allow otapreopt_chroot to restore the security context of /postinstall/apex. 61allow otapreopt_chroot tmpfs:dir relabelfrom; 62allow otapreopt_chroot postinstall_apex_mnt_dir:dir relabelto; 63 64# Allow otapreopt_chroot to manipulate directory /postinstall/apex. 65allow otapreopt_chroot postinstall_apex_mnt_dir:dir create_dir_perms; 66# Allow otapreopt_chroot to mount APEX packages in /postinstall/apex. 67allow otapreopt_chroot postinstall_apex_mnt_dir:dir mounton; 68 69# Allow otapreopt_chroot to access /dev/block (needed to detach loop 70# devices used by ext4 images from APEX packages). 71allow otapreopt_chroot block_device:dir r_dir_perms; 72 73# Allow to access the linker through the symlink. 74allow otapreopt_chroot postinstall_file:lnk_file r_file_perms; 75