From 4f6d8e928471859d86500ef3a4078eb86b34e934 Mon Sep 17 00:00:00 2001 From: oxmc Date: Sun, 16 Aug 2026 19:53:50 -0700 Subject: [PATCH] sepolicy: flip pawlet_cache to enforcing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Traced every code path (CacheOrchestrator, MdnsDiscovery, CentralLookupClient, PolicyOverride, PawletCacheService) against pawlet_cache.te — no gaps found, existing rules already match what the code actually does. --- sepolicy/pawlet_cache.te | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/sepolicy/pawlet_cache.te b/sepolicy/pawlet_cache.te index 15ea7f8..5583ec4 100644 --- a/sepolicy/pawlet_cache.te +++ b/sepolicy/pawlet_cache.te @@ -1,13 +1,17 @@ # pawlet-cache (os.pawlet.cache) — platform-signed app, LAN content-cache resolver. # Bound by bg_upd (and later OTA/media resolvers) via IPawletCacheService. # -# Seeded in permissive mode, same caveat as bg_upd.te: shaped from the actual -# code paths (NsdManager discovery, HTTPS central lookup, policy override file -# read) but not yet validated against real avc denials on-device. +# Rules below were reconciled against every real code path in this repo +# (CacheOrchestrator, MdnsDiscovery, CentralLookupClient, PolicyOverride, +# PawletCacheService) — traced source-to-sepolicy, not live avc denials, same +# caveat as bg_upd.te. No gaps found: NsdManager discovery routes through +# system_server + servicediscovery_service (both already granted below), +# CentralLookupClient is plain HTTPS (net_domain), and both policy file tiers +# (pawletcache_policy_file, vendor_configs_file) already match Constants.kt's +# POLICY_OVERRIDE_PATH/VENDOR_POLICY_PATH exactly. type pawlet_cache, domain, coredomain; app_domain(pawlet_cache) -permissive pawlet_cache; type pawlet_cache_data_file, file_type, data_file_type, app_data_file_type;