diff --git a/private/apexd.te b/private/apexd.te index bed895306fe4452cd627cc6c6ec4840700567109..4850d617d0e3d959bc70720f1f869fed6a0b4edc 100644 --- a/private/apexd.te +++ b/private/apexd.te @@ -68,5 +68,5 @@ allow apexd sysfs_loop:file rw_file_perms; dontaudit apexd self:global_capability_class_set { dac_override dac_read_search }; neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms; -neverallow { domain -apexd -init -kernel } apex_data_file:file no_rw_file_perms; +neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms; neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms; diff --git a/private/system_server.te b/private/system_server.te index f3d2ffd99582415fd8a5a4fb4bf651aa893d5703..4581417a5552e93887111f64f51f748c7fe8ede7 100644 --- a/private/system_server.te +++ b/private/system_server.te @@ -963,6 +963,13 @@ allow system_server system_server_startup:unix_dgram_socket write; allow system_server apex_service:service_manager find; allow system_server apexd:binder call; +# Allow the system server to read files under /data/apex. The system_server +# needs these privileges to compare file signatures while processing installs. +# +# Only apexd is allowed to create new entries or write to any file under /data/apex. +allow system_server apex_data_file:dir search; +allow system_server apex_data_file:file r_file_perms; + # dexoptanalyzer is currently used only for secondary dex files which # system_server should never access. neverallow system_server dexoptanalyzer_exec:file no_x_file_perms;