oxmc
a1ff8098cc
- CacheResolverClient/SpkiPinning: resolve component downloads through os.pawlet.cache's IPawletCacheService when available (SPKI-pinned), falling back to the origin URL otherwise. sepolicy domain (bg_upd.te, seapp_contexts) for the new binder client + apps.php dispatcher. - PolicyReader: read the policy PawletProfiled/pawletprofiled's software-update MDM payload handler writes to /data/system/pawletos/software_update_policy.json (previously unread on either platform). Wired into the scheduled JobService and UpdateExecutor: autoCheck=false skips the periodic check outright; autoDownload/ autoInstall=false stages found updates instead of silently installing them; deferDays holds a staged update until it's been pending that long (new pending_first_seen_at column, DB v2 -> v3). Explicit user/MDM- triggered checks and installs are unaffected — the policy only throttles the automatic path, matching the payload's own field names.
4 lines
231 B
Plaintext
4 lines
231 B
Plaintext
# bg-upd runs in its own scoped domain (see bg_upd.te) rather than the default
|
|
# platform_app domain every other priv-app falls into.
|
|
user=_app seinfo=platform name=os.pawlet.bgupd domain=bg_upd type=bg_upd_data_file levelFrom=all
|