oxmc
4f6d8e9284
Traced every code path (CacheOrchestrator, MdnsDiscovery, CentralLookupClient, PolicyOverride, PawletCacheService) against pawlet_cache.te — no gaps found, existing rules already match what the code actually does.
44 lines
2.2 KiB
Plaintext
44 lines
2.2 KiB
Plaintext
# pawlet-cache (os.pawlet.cache) — platform-signed app, LAN content-cache resolver.
|
|
# Bound by bg_upd (and later OTA/media resolvers) via IPawletCacheService.
|
|
#
|
|
# Rules below were reconciled against every real code path in this repo
|
|
# (CacheOrchestrator, MdnsDiscovery, CentralLookupClient, PolicyOverride,
|
|
# PawletCacheService) — traced source-to-sepolicy, not live avc denials, same
|
|
# caveat as bg_upd.te. No gaps found: NsdManager discovery routes through
|
|
# system_server + servicediscovery_service (both already granted below),
|
|
# CentralLookupClient is plain HTTPS (net_domain), and both policy file tiers
|
|
# (pawletcache_policy_file, vendor_configs_file) already match Constants.kt's
|
|
# POLICY_OVERRIDE_PATH/VENDOR_POLICY_PATH exactly.
|
|
|
|
type pawlet_cache, domain, coredomain;
|
|
app_domain(pawlet_cache)
|
|
|
|
type pawlet_cache_data_file, file_type, data_file_type, app_data_file_type;
|
|
|
|
# Central lookup (HTTPS) + cache server asset fetches happen in bg_upd, not
|
|
# here — pawlet_cache itself only needs network for central lookup requests
|
|
# made during discovery and for NSD's underlying mDNS multicast traffic.
|
|
net_domain(pawlet_cache)
|
|
|
|
allow pawlet_cache pawlet_cache_data_file:dir create_dir_perms;
|
|
allow pawlet_cache pawlet_cache_data_file:file create_file_perms;
|
|
|
|
# NsdManager discovery/resolve calls route through system_server to mdnsd.
|
|
binder_call(pawlet_cache, system_server)
|
|
allow pawlet_cache servicediscovery_service:service_manager find;
|
|
|
|
# Callers bind IPawletCacheService — see bg_upd.te's binder_call(bg_upd, pawlet_cache).
|
|
|
|
# Enterprise policy override, written by pawletprofiled
|
|
# (git.oxmc.me/PawletOS/profiled — see PolicyOverride.kt). Write-side
|
|
# sepolicy rule lives in that repo's pawletprofiled.te.
|
|
type pawletcache_policy_file, file_type, data_file_type;
|
|
allow pawlet_cache pawletcache_policy_file:file { read open getattr };
|
|
allow pawlet_cache pawletcache_policy_file:dir { read open getattr search };
|
|
|
|
# OEM/vendor-baked default policy (read-only, build-time) — see
|
|
# vendor-config/README.md and sepolicy/file_contexts. Lives under
|
|
# /vendor/etc/pawletcache, labeled vendor_configs_file by AOSP's default
|
|
# file_contexts pattern; no per-domain allow rule needed since every domain
|
|
# already has blanket read access to vendor_configs_file platform-wide.
|