diff --git a/file.te b/file.te index 8b525daac081429a5cfbbad6a536185e074ec2a7..ce9eff9f8714cd4572ed64d286e62d0f76e4dc6e 100644 --- a/file.te +++ b/file.te @@ -110,6 +110,8 @@ type heapdump_data_file, file_type, data_file_type, mlstrustedobject; type nativetest_data_file, file_type, data_file_type; # /data/system_de/0/ringtones type ringtone_file, file_type, data_file_type, mlstrustedobject; +# /data/preloads +type preloads_data_file, file_type, data_file_type; # Mount locations managed by vold type mnt_media_rw_file, file_type; diff --git a/file_contexts b/file_contexts index c4f8f6a4b10b7f1b91ec6c6cac9f0d02277b12b6..062b929378959aab99221a85152a6e226e37aa00 100644 --- a/file_contexts +++ b/file_contexts @@ -260,6 +260,7 @@ /data/mediadrm(/.*)? u:object_r:media_data_file:s0 /data/nativetest(/.*)? u:object_r:nativetest_data_file:s0 /data/property(/.*)? u:object_r:property_data_file:s0 +/data/preloads(/.*)? u:object_r:preloads_data_file:s0 # Misc data /data/misc/adb(/.*)? u:object_r:adb_keys_file:s0 diff --git a/platform_app.te b/platform_app.te index 8ac79327e0a84bc967a0e0010317539a252ff1f3..0d3bdba1cd463689fe1c02c98990c707964ccfa0 100644 --- a/platform_app.te +++ b/platform_app.te @@ -51,3 +51,7 @@ allow platform_app surfaceflinger_service:service_manager find; allow platform_app app_api_service:service_manager find; allow platform_app system_api_service:service_manager find; allow platform_app vr_manager_service:service_manager find; + +# Access to /data/preloads +allow platform_app preloads_data_file:file r_file_perms; +allow platform_app preloads_data_file:dir r_dir_perms; diff --git a/priv_app.te b/priv_app.te index 58016195a7a7ab837aa74951e6e2d491238e0959..d380a67a2252b63b955adcf4cf42094df574fe2f 100644 --- a/priv_app.te +++ b/priv_app.te @@ -92,6 +92,10 @@ allow priv_app update_engine_service:service_manager find; # Allow Phone to read/write cached ringtones (opened by system). allow priv_app ringtone_file:file { getattr read write }; +# Access to /data/preloads +allow priv_app preloads_data_file:file r_file_perms; +allow priv_app preloads_data_file:dir r_dir_perms; + ### ### neverallow rules ### diff --git a/system_server.te b/system_server.te index 6b2fa7e0cf875daccbac24f10681c8f8c1df7222..b205c2429926bc0675fc6bbcc8ecc052aaece911 100644 --- a/system_server.te +++ b/system_server.te @@ -529,6 +529,10 @@ allow system_server postinstall:fifo_file write; allow system_server update_engine:fd use; allow system_server update_engine:fifo_file write; +# Access to /data/preloads +allow system_server preloads_data_file:file { r_file_perms unlink }; +allow system_server preloads_data_file:dir { r_dir_perms write remove_name }; + ### ### Neverallow rules ###