1# odrefresh
2type odrefresh, domain, coredomain;
3type odrefresh_exec, system_file_type, exec_type, file_type;
4
5# Allow odrefresh to create files and directories for on device signing.
6allow odrefresh apex_module_data_file:dir { getattr search };
7allow odrefresh apex_art_data_file:dir { create_dir_perms relabelfrom };
8allow odrefresh apex_art_data_file:file create_file_perms;
9
10# Allow odrefresh to create data files (typically for metrics before statsd starts).
11allow odrefresh odrefresh_data_file:dir create_dir_perms;
12allow odrefresh odrefresh_data_file:file create_file_perms;
13
14userfaultfd_use(odrefresh)
15
16# Staging area labels (/data/misc/apexdata/com.android.art/staging). odrefresh
17# sets up files here and passes file descriptors for dex2oat to write to.
18allow odrefresh apex_art_staging_data_file:dir { create_dir_perms relabelto };
19allow odrefresh apex_art_staging_data_file:file create_file_perms;
20
21# Run dex2oat in its own sandbox.
22domain_auto_trans(odrefresh, dex2oat_exec, dex2oat)
23
24# Allow odrefresh to kill dex2oat if compilation times out.
25allow odrefresh dex2oat:process sigkill;
26
27# Run dexoptanalyzer in its own sandbox.
28domain_auto_trans(odrefresh, dexoptanalyzer_exec, dexoptanalyzer)
29
30# Allow odrefresh to kill dexoptanalyzer if analysis times out.
31allow odrefresh dexoptanalyzer:process sigkill;
32
33# Use devpts and fd from odsign (which exec()'s odrefresh)
34allow odrefresh odsign_devpts:chr_file { read write };
35allow odrefresh odsign:fd use;
36
37# Do not audit unused resources from parent processes (adb, shell, su).
38# These appear to be unnecessary for odrefresh.
39dontaudit odrefresh { adbd shell }:fd use;
40dontaudit odrefresh devpts:chr_file rw_file_perms;
41dontaudit odrefresh adbd:unix_stream_socket { getattr read write };
42
43# Allow odrefresh to read /apex/apex-info-list.xml to determine
44# whether current apex is in /system or /data.
45allow odrefresh apex_info_file:file r_file_perms;
46
47# No other processes should be creating files in the staging area.
48neverallow { domain -init -odrefresh } apex_art_staging_data_file:file open;
49
50# No processes other than init, odrefresh and system_server access
51# odrefresh_data_files.
52neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:dir *;
53neverallow { domain -init -odrefresh -system_server } odrefresh_data_file:file *;
54
55# Allow updating boot animation status.
56set_prop(odrefresh, bootanim_system_prop)
57
58# Allow query ART device config properties
59get_prop(odrefresh, device_config_runtime_native_prop)
60get_prop(odrefresh, device_config_runtime_native_boot_prop)
61