PawletOS/android_packages_apps_PawletCache
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sepolicy: rely on built-in vendor_configs_file instead of a custom type

Browse Source 
The custom pawletcache_vendor_config_file type/label tripped Treble's
coredomain-can't-read-/vendor neverallow, since a hand-rolled
vendor_file_type subtype isn't in that rule's exception list. Dropping the
override lets /vendor/etc/pawletcache fall under AOSP's default
vendor_configs_file labeling, which every domain already has blanket read
access to.
This commit is contained in:
oxmc
2026-08-15 16:10:26 -07:00
parent d693b91f34
commit a951846e33
2 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sepolicy/file_contexts
+7 -2
View File
@@ -1,4 +1,9 @@
/data/misc/pawletcache(/.*)? u:object_r:pawletcache_policy_file:s0
# OEM/vendor-baked default policy — see vendor-config/README.md.
/vendor/etc/pawletcache(/.*)? u:object_r:pawletcache_vendor_config_file:s0
# OEM/vendor-baked default policy — see vendor-config/README.md. No custom
# type/label needed: this falls under AOSP's default /vendor/etc(/.*)? ->
# vendor_configs_file file_contexts pattern, and every domain already has
# blanket read access to vendor_configs_file (system/sepolicy/private/
# domain.te). A custom vendor_file_type subtype here would trip the
# coredomain-can't-read-/vendor neverallow, since it isn't in that rule's
# exception list the way vendor_configs_file is.
sepolicy/pawlet_cache.te
+4 -5
View File
@@ -33,8 +33,7 @@ allow pawlet_cache pawletcache_policy_file:file { read open getattr };
allow pawlet_cache pawletcache_policy_file:dir { read open getattr search };
# OEM/vendor-baked default policy (read-only, build-time) — see
# vendor-config/README.md. vendor_file_type is required for a type to live
# under /vendor per Treble's vendor/system sepolicy split.
type pawletcache_vendor_config_file, file_type, vendor_file_type;
allow pawlet_cache pawletcache_vendor_config_file:file { read open getattr };
allow pawlet_cache pawletcache_vendor_config_file:dir { read open getattr search };
# vendor-config/README.md and sepolicy/file_contexts. Lives under
# /vendor/etc/pawletcache, labeled vendor_configs_file by AOSP's default
# file_contexts pattern; no per-domain allow rule needed since every domain
# already has blanket read access to vendor_configs_file platform-wide.