Skip to content
Snippets Groups Projects
  • Nick Kralevich's avatar
    installd: r_dir_file(installd, system_file) · 68f23364
    Nick Kralevich authored
    Allow installd to read through files, directories, and symlinks
    on /system. This is needed to support installd using files in
    /system/app and /system/priv-app
    
    Addresses the following auditallow spam:
    
    avc: granted { getattr } for comm="installd"
    path="/system/app/Bluetooth/lib/arm/libbluetooth_jni.so"
    dev="mmcblk0p41" ino=19 scontext=u:r:installd:s0
    tcontext=u:object_r:system_file:s0 tclass=lnk_file
    
    avc: granted { getattr } for comm="installd"
    path="/system/priv-app/MtpDocumentsProvider/lib/arm64/libappfuse_jni.so"
    dev="dm-0" ino=2305 scontext=u:r:installd:s0
    tcontext=u:object_r:system_file:s0 tclass=lnk_file
    
    avc: granted { read open } for comm="installd"
    path="/system/priv-app/TelephonyProvider" dev="mmcblk0p43" ino=1839
    scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0 tclass=dir
    
    avc: granted { read } for comm="installd" name="Velvet" dev="mmcblk0p43"
    ino=1841 scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0
    tclass=dir
    
    avc: granted { read open } for comm="installd"
    path="/system/priv-app/GoogleOneTimeInitializer" dev="mmcblk0p43"
    ino=1778 scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0
    tclass=dir
    
    avc: granted { read open } for comm="installd"
    path="/system/app/PlayAutoInstallConfig" dev="mmcblk0p43" ino=112
    scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0 tclass=dir
    
    Test: policy compiles
    Change-Id: I5d14ea2cd7d281f949d0651b9723d5b7fae2e1f2
    68f23364