Skip to content

Commit eab1c9a

Browse files
thestingerrandomhydrosol
authored andcommitted
auditallow apk_data_file execute
For libraries, apps should be migrating to the more modern approach of storing them in the apk uncompressed and mapping them directly from it. This is the most modern approach available for executables and is better than using app data, but ideally it wouldn't be done. For now, audit use of `execute_no_trans` anyway while this is given more thought. Signed-off-by: anupritaisno1 <[email protected]>
1 parent 1b70770 commit eab1c9a

File tree

2 files changed

+2
-0
lines changed

2 files changed

+2
-0
lines changed

prebuilts/api/30.0/public/app.te

+1
Original file line numberDiff line numberDiff line change
@@ -275,6 +275,7 @@ allow appdomain shared_relro_file:file r_file_perms;
275275
# Allow apps to read/execute installed binaries
276276
allow appdomain apk_data_file:dir r_dir_perms;
277277
allow appdomain apk_data_file:file rx_file_perms;
278+
auditallow appdomain apk_data_file:file { execute execute_no_trans };
278279

279280
# /data/resource-cache
280281
allow appdomain resourcecache_data_file:file r_file_perms;

public/app.te

+1
Original file line numberDiff line numberDiff line change
@@ -275,6 +275,7 @@ allow appdomain shared_relro_file:file r_file_perms;
275275
# Allow apps to read/execute installed binaries
276276
allow appdomain apk_data_file:dir r_dir_perms;
277277
allow appdomain apk_data_file:file rx_file_perms;
278+
auditallow appdomain apk_data_file:file { execute execute_no_trans };
278279

279280
# /data/resource-cache
280281
allow appdomain resourcecache_data_file:file r_file_perms;

0 commit comments

Comments
 (0)