1# otapreopt_chroot executable
2type otapreopt_chroot, domain, coredomain;
3type otapreopt_chroot_exec, system_file_type, exec_type, file_type;
4
5# Chroot preparation and execution.
6# We need to create an unshared mount namespace, and then mount /data.
7allow otapreopt_chroot postinstall_file:dir { search mounton };
8allow otapreopt_chroot self:global_capability_class_set { sys_admin sys_chroot };
9
10# This is required to mount /vendor and mount/unmount ext4 images from
11# APEX packages in /postinstall/apex.
12allow otapreopt_chroot block_device:dir search;
13allow otapreopt_chroot labeledfs:filesystem { mount unmount };
14# This is required for dynamic partitions.
15allow otapreopt_chroot dm_device:chr_file rw_file_perms;
16
17# This is required to unmount flattened APEX packages under
18# /postinstall/system/apex (which are bind-mounted in /postinstall/apex).
19allow otapreopt_chroot postinstall_file:filesystem unmount;
20# Mounting /vendor can have this side-effect. Ignore denial.
21dontaudit otapreopt_chroot kernel:process setsched;
22
23# Allow otapreopt_chroot to read SELinux policy files.
24allow otapreopt_chroot file_contexts_file:file r_file_perms;
25
26# Allow otapreopt_chroot to open and read the contents of /postinstall/system/apex.
27allow otapreopt_chroot postinstall_file:dir r_dir_perms;
28# Allow otapreopt_chroot to read the persist.apexd.verity_on_system system property.
29get_prop(otapreopt_chroot, apexd_prop)
30
31# Allow otapreopt to use file descriptors from update-engine. It will
32# close them immediately.
33allow otapreopt_chroot postinstall:fd use;
34allow otapreopt_chroot update_engine:fd use;
35allow otapreopt_chroot update_engine:fifo_file write;
36
37# Allow to transition to postinstall_dexopt, to run otapreopt in its own sandbox.
38domain_auto_trans(otapreopt_chroot, postinstall_file, postinstall_dexopt)
39
40# Allow otapreopt_chroot to create loop devices with /dev/loop-control.
41allow otapreopt_chroot loop_control_device:chr_file rw_file_perms;
42# Allow otapreopt_chroot to access loop devices.
43allow otapreopt_chroot loop_device:blk_file rw_file_perms;
44allowxperm otapreopt_chroot loop_device:blk_file ioctl {
45  LOOP_GET_STATUS64
46  LOOP_SET_STATUS64
47  LOOP_SET_FD
48  LOOP_SET_BLOCK_SIZE
49  LOOP_SET_DIRECT_IO
50  LOOP_CLR_FD
51  BLKFLSBUF
52};
53
54# Allow otapreopt_chroot to configure read-ahead of loop devices.
55allow otapreopt_chroot sysfs_loop:dir r_dir_perms;
56allow otapreopt_chroot sysfs_loop:file rw_file_perms;
57
58# Allow otapreopt_chroot to mount a tmpfs filesystem in /postinstall/apex.
59allow otapreopt_chroot tmpfs:filesystem mount;
60# Allow otapreopt_chroot to restore the security context of /postinstall/apex.
61allow otapreopt_chroot tmpfs:dir relabelfrom;
62allow otapreopt_chroot postinstall_apex_mnt_dir:dir relabelto;
63
64# Allow otapreopt_chroot to manipulate directory /postinstall/apex.
65allow otapreopt_chroot postinstall_apex_mnt_dir:dir create_dir_perms;
66# Allow otapreopt_chroot to mount APEX packages in /postinstall/apex.
67allow otapreopt_chroot postinstall_apex_mnt_dir:dir mounton;
68
69# Allow otapreopt_chroot to access /dev/block (needed to detach loop
70# devices used by ext4 images from APEX packages).
71allow otapreopt_chroot block_device:dir r_dir_perms;
72
73# Allow to access the linker through the symlink.
74allow otapreopt_chroot postinstall_file:lnk_file r_file_perms;
75