oxmc
ae9e830f7f
Bound service BgUpd consults before downloading component assets: discovers a trusted cache server (mDNS and/or central lookup, policy- configurable), verifies its signed CacheToken against a pinned root key, and hands back a rewritten URL + TLS pin. Three-tier discovery policy (runtime MDM override -> vendor-baked default -> compiled default). Pairs with pawletcache-server (the LAN daemon) and BgUpd (the caller).
42 lines
2.1 KiB
Plaintext
42 lines
2.1 KiB
Plaintext
# pawlet-cache (os.pawlet.cache) — platform-signed app, LAN content-cache resolver.
|
|
# Bound by bg_upd (and later OTA/media resolvers) via IPawletCacheService.
|
|
#
|
|
# Seeded in permissive mode, same caveat as bg_upd.te: shaped from the actual
|
|
# code paths (NsdManager discovery, HTTPS central lookup, policy override file
|
|
# read) but not yet validated against real avc denials on-device.
|
|
|
|
type pawlet_cache, domain, coredomain;
|
|
app_domain(pawlet_cache)
|
|
permissive pawlet_cache;
|
|
|
|
type pawlet_cache_data_file, file_type, data_file_type, app_data_file_type;
|
|
|
|
# Central lookup (HTTPS) + cache server asset fetches happen in bg_upd, not
|
|
# here — pawlet_cache itself only needs network for central lookup requests
|
|
# made during discovery and for NSD's underlying mDNS multicast traffic.
|
|
net_domain(pawlet_cache)
|
|
|
|
allow pawlet_cache pawlet_cache_data_file:dir create_dir_perms;
|
|
allow pawlet_cache pawlet_cache_data_file:file create_file_perms;
|
|
|
|
# NsdManager discovery/resolve calls route through system_server to mdnsd.
|
|
binder_call(pawlet_cache, system_server)
|
|
allow pawlet_cache servicediscovery_service:service_manager find;
|
|
|
|
# Callers bind IPawletCacheService — see bg_upd.te's binder_call(bg_upd, pawlet_cache).
|
|
|
|
# Enterprise policy override, written by PawletOS's own fork of vesperprofiled
|
|
# (git.oxmc.me/PawletOS/profiled — see PolicyOverride.kt). Its
|
|
# ContentCacheHandler doesn't exist in vesperprofiled's default VesperOS
|
|
# build; write-side sepolicy rule lives in that fork's vesperprofiled.te.
|
|
type pawletcache_policy_file, file_type, data_file_type;
|
|
allow pawlet_cache pawletcache_policy_file:file { read open getattr };
|
|
allow pawlet_cache pawletcache_policy_file:dir { read open getattr search };
|
|
|
|
# OEM/vendor-baked default policy (read-only, build-time) — see
|
|
# vendor-config/README.md. vendor_file_type is required for a type to live
|
|
# under /vendor per Treble's vendor/system sepolicy split.
|
|
type pawletcache_vendor_config_file, file_type, vendor_file_type;
|
|
allow pawlet_cache pawletcache_vendor_config_file:file { read open getattr };
|
|
allow pawlet_cache pawletcache_vendor_config_file:dir { read open getattr search };
|