pa: Introduce sepolicy exceptions for theme assets

Assets such as composed icons and ringtones need to be accessed
by apps. This patch adds the policy needed to facilitate this.

Change-Id: I0420de579aed0cff5add181cd0a8bf0f2b05d723
This commit is contained in:
d34d 2017-01-04 10:29:34 -08:00 committed by Alex Naidis
parent 1b817c5135
commit 2ef1577fda
7 changed files with 21 additions and 0 deletions

3
sepolicy/app.te Normal file
View File

@ -0,0 +1,3 @@
# Themed resources (i.e. composed icons)
allow appdomain theme_data_file:dir r_dir_perms;
allow appdomain theme_data_file:file r_file_perms;

3
sepolicy/bootanim.te Normal file
View File

@ -0,0 +1,3 @@
# Themed resources (bootanimation)
allow bootanim theme_data_file:dir search;
allow bootanim theme_data_file:file r_file_perms;

2
sepolicy/file.te Normal file
View File

@ -0,0 +1,2 @@
# Themes
type theme_data_file, file_type, data_file_type;

View File

@ -6,3 +6,6 @@
# fsck
/system/bin/fsck\.ntfs u:object_r:fsck_exec:s0
/system/bin/fsck\.exfat u:object_r:fsck_exec:s0
# Themes
/data/system/theme(/.*)? u:object_r:theme_data_file:s0

3
sepolicy/mediaserver.te Normal file
View File

@ -0,0 +1,3 @@
# Themed resources (i.e. composed icons)
allow mediaserver theme_data_file:dir r_dir_perms;
allow mediaserver theme_data_file:file r_file_perms;

3
sepolicy/system_app.te Normal file
View File

@ -0,0 +1,3 @@
# Themes
allow system_app theme_data_file:dir create_dir_perms;
allow system_app theme_data_file:file create_file_perms;

View File

@ -1 +1,5 @@
allow zygote self:capability sys_nice;
# Themes
allow zygote theme_data_file:file r_file_perms;
allow zygote theme_data_file:dir r_dir_perms;