1 2# Domain for derive_classpath 3type derive_classpath, domain, coredomain, artd_subprocess_type; 4type derive_classpath_exec, system_file_type, exec_type, file_type; 5init_daemon_domain(derive_classpath) 6 7# Read /apex 8allow derive_classpath apex_mnt_dir:dir r_dir_perms; 9allow derive_classpath vendor_apex_metadata_file:dir r_dir_perms; 10 11# Create /data/system/environ/classpath file 12allow derive_classpath environ_system_data_file:dir rw_dir_perms; 13allow derive_classpath environ_system_data_file:file create_file_perms; 14 15# b/183079517 fails on gphone targets otherwise 16allow derive_classpath unlabeled:dir search; 17 18# Allow derive_classpath to write the classpath into ota dexopt 19# - Read the ota's apex dir 20allow derive_classpath postinstall_apex_mnt_dir:dir r_dir_perms; 21# - Report the BCP to the ota's dexopt 22allow derive_classpath postinstall_dexopt:dir search; 23allow derive_classpath postinstall_dexopt:fd use; 24allow derive_classpath postinstall_dexopt:file read; 25allow derive_classpath postinstall_dexopt:lnk_file read; 26allow derive_classpath postinstall_dexopt_tmpfs:file rw_file_perms; 27 28# Allow to be called by artd in Pre-reboot Dexopt. 29allow derive_classpath artd:fd use; 30 31# Allow writing to Pre-reboot Dexopt temp files. 32allow derive_classpath pre_reboot_dexopt_artd_file:file { open read write }; 33