1# idmap, when executed by installd 2type idmap, domain; 3type idmap_exec, system_file_type, exec_type, file_type; 4 5# TODO remove /system/bin/idmap and the link between idmap and installd (b/118711077) 6# Use open file to /data/resource-cache file inherited from installd. 7allow idmap installd:fd use; 8allow idmap resourcecache_data_file:file create_file_perms; 9allow idmap resourcecache_data_file:dir rw_dir_perms; 10 11# Ignore reading /proc/<pid>/maps after a fork. 12dontaudit idmap installd:file read; 13 14# Open and read from target and overlay apk files passed by argument. 15allow idmap apk_data_file:file r_file_perms; 16allow idmap apk_data_file:dir search; 17 18# Allow /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files 19allow idmap { apk_tmp_file apk_private_tmp_file }:file r_file_perms; 20allow idmap { apk_tmp_file apk_private_tmp_file }:dir search; 21 22# Allow apps access to /vendor/app 23r_dir_file(idmap, vendor_app_file) 24 25# Allow apps access to /vendor/overlay 26r_dir_file(idmap, vendor_overlay_file) 27 28# Allow the idmap2d binary to register as a service and communicate via AIDL 29binder_use(idmap) 30binder_service(idmap) 31add_service(idmap, idmap_service) 32