From a951846e33b5f5d4a7c696b04112d21215d4894e Mon Sep 17 00:00:00 2001 From: oxmc Date: Sat, 15 Aug 2026 16:10:26 -0700 Subject: [PATCH] sepolicy: rely on built-in vendor_configs_file instead of a custom type The custom pawletcache_vendor_config_file type/label tripped Treble's coredomain-can't-read-/vendor neverallow, since a hand-rolled vendor_file_type subtype isn't in that rule's exception list. Dropping the override lets /vendor/etc/pawletcache fall under AOSP's default vendor_configs_file labeling, which every domain already has blanket read access to. --- sepolicy/file_contexts | 9 +++++++-- sepolicy/pawlet_cache.te | 9 ++++----- 2 files changed, 11 insertions(+), 7 deletions(-) diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts index eb69f10..97d7c77 100644 --- a/sepolicy/file_contexts +++ b/sepolicy/file_contexts @@ -1,4 +1,9 @@ /data/misc/pawletcache(/.*)? u:object_r:pawletcache_policy_file:s0 -# OEM/vendor-baked default policy — see vendor-config/README.md. -/vendor/etc/pawletcache(/.*)? u:object_r:pawletcache_vendor_config_file:s0 +# OEM/vendor-baked default policy — see vendor-config/README.md. No custom +# type/label needed: this falls under AOSP's default /vendor/etc(/.*)? -> +# vendor_configs_file file_contexts pattern, and every domain already has +# blanket read access to vendor_configs_file (system/sepolicy/private/ +# domain.te). A custom vendor_file_type subtype here would trip the +# coredomain-can't-read-/vendor neverallow, since it isn't in that rule's +# exception list the way vendor_configs_file is. diff --git a/sepolicy/pawlet_cache.te b/sepolicy/pawlet_cache.te index ccc1d54..15ea7f8 100644 --- a/sepolicy/pawlet_cache.te +++ b/sepolicy/pawlet_cache.te @@ -33,8 +33,7 @@ allow pawlet_cache pawletcache_policy_file:file { read open getattr }; allow pawlet_cache pawletcache_policy_file:dir { read open getattr search }; # OEM/vendor-baked default policy (read-only, build-time) — see -# vendor-config/README.md. vendor_file_type is required for a type to live -# under /vendor per Treble's vendor/system sepolicy split. -type pawletcache_vendor_config_file, file_type, vendor_file_type; -allow pawlet_cache pawletcache_vendor_config_file:file { read open getattr }; -allow pawlet_cache pawletcache_vendor_config_file:dir { read open getattr search }; +# vendor-config/README.md and sepolicy/file_contexts. Lives under +# /vendor/etc/pawletcache, labeled vendor_configs_file by AOSP's default +# file_contexts pattern; no per-domain allow rule needed since every domain +# already has blanket read access to vendor_configs_file platform-wide.