diff --git a/private/app.te b/private/app.te index a086b8664b39cc98eb0cb7a2fa647b91bca2ccd7..73d77299591ec35fab15f6b449ca631f25b2ff6c 100644 --- a/private/app.te +++ b/private/app.te @@ -98,6 +98,9 @@ allow appdomain system_file:lnk_file { getattr open read }; # apps which cannot be in /vendor. r_dir_file({ appdomain -ephemeral_app -untrusted_v2_app }, vendor_app_file) +# Allow apps access to /vendor/overlay +r_dir_file(appdomain, vendor_overlay_file) + # Execute dex2oat when apps call dexclassloader allow appdomain dex2oat_exec:file rx_file_perms; diff --git a/private/system_server.te b/private/system_server.te index 430234313c684d99e635f72cf2c7fb576a083196..90e8b10ed0b059de59bfcde227c8f2a8d8c8e9bb 100644 --- a/private/system_server.te +++ b/private/system_server.te @@ -297,6 +297,9 @@ allow system_server apk_tmp_file:file create_file_perms; # Access /vendor/app r_dir_file(system_server, vendor_app_file) +# Access /vendor/app +r_dir_file(system_server, vendor_overlay_file) + # Manage /data/app-private. allow system_server apk_private_data_file:dir create_dir_perms; allow system_server apk_private_data_file:file create_file_perms; diff --git a/private/zygote.te b/private/zygote.te index 15fd951952756e30159a4c76f0f329339ba39751..52250f8f85587aa572c8bb6127859b405111ac92 100644 --- a/private/zygote.te +++ b/private/zygote.te @@ -51,6 +51,10 @@ allow { zygote with_dexpreopt(`-zygote') } dalvikcache_data_file:file execute; allow zygote idmap_exec:file rx_file_perms; allow zygote dex2oat_exec:file rx_file_perms; +# /vendor/overlay existence is checked before +# passing it on as an argument to idmap in AssetManager +allow zygote vendor_overlay_file:dir { getattr open read search }; + # Control cgroups. allow zygote cgroup:dir create_dir_perms; allow zygote cgroup:{ file lnk_file } r_file_perms; diff --git a/public/domain.te b/public/domain.te index 92ebde01d546504b0c71ab5b1e83da47e542baf4..ffa8d44a84c1a5b29f03d0ca7d8b7c830652ee48 100644 --- a/public/domain.te +++ b/public/domain.te @@ -136,11 +136,6 @@ full_treble_only(` # TODO: b/36806861 allow domain vendor_app_file:lnk_file { open read }; - # TODO: b/36656392, find out who needs access and only allow - # specific domains. - allow domain vendor_overlay_file:dir r_dir_perms; - allow domain vendor_overlay_file:file { read open getattr }; - # TODO: b/36680116, find out who neeeds access and only allow # specific domains allow domain vendor_framework_file:dir r_dir_perms; @@ -687,7 +682,7 @@ full_treble_only(` # On TREBLE devices, a limited set of files in /vendor are accessible to # only a few whitelisted coredomains to keep system/vendor separation. full_treble_only(` - # Limit access to /vendor/app except for whitelisted domains + # Limit access to /vendor/app neverallow { coredomain -appdomain @@ -707,6 +702,25 @@ full_treble_only(` -installd -system_server } vendor_app_file:{ file lnk_file } r_file_perms; + + # Limit access to /vendor/overlay + neverallow { + coredomain + -appdomain + -idmap + -init + -system_server + -zygote + } vendor_overlay_file:dir { getattr open read search }; + + neverallow { + coredomain + -appdomain + -idmap + -init + -system_server + -zygote + } vendor_overlay_file:{ file lnk_file } r_file_perms; ') # Only authorized processes should be writing to files in /data/dalvik-cache diff --git a/public/idmap.te b/public/idmap.te index 437e0cc6d0776471928ad5c296d99872a25b3c34..1c32f8fd54ce8721c21dc09f539865368aa47275 100644 --- a/public/idmap.te +++ b/public/idmap.te @@ -12,3 +12,6 @@ allow idmap apk_data_file:dir search; # Allow apps access to /vendor/app r_dir_file(idmap, vendor_app_file) + +# Allow apps access to /vendor/overlay +r_dir_file(idmap, vendor_overlay_file)