1typeattribute installd coredomain;
2
3init_daemon_domain(installd)
4
5# Run dex2oat in its own sandbox.
6domain_auto_trans(installd, dex2oat_exec, dex2oat)
7
8# Run dexoptanalyzer in its own sandbox.
9domain_auto_trans(installd, dexoptanalyzer_exec, dexoptanalyzer)
10
11# Run viewcompiler in its own sandbox.
12domain_auto_trans(installd, viewcompiler_exec, viewcompiler)
13
14# Run profman in its own sandbox.
15domain_auto_trans(installd, profman_exec, profman)
16
17# Run idmap in its own sandbox.
18domain_auto_trans(installd, idmap_exec, idmap)
19
20# Run migrate_legacy_obb_data.sh in its own sandbox.
21domain_auto_trans(installd, migrate_legacy_obb_data_exec, migrate_legacy_obb_data)
22allow installd shell_exec:file rx_file_perms;
23
24# Create /data/.layout_version.* file
25type_transition installd system_data_file:file install_data_file;
26
27# For collecting bugreports.
28allow installd dumpstate:fd use;
29allow installd dumpstate:fifo_file r_file_perms;
30
31# Delete /system/bin/bcc generated artifacts
32allow installd app_exec_data_file:file unlink;
33
34# Capture userdata snapshots to /data/misc_[ce|de]/rollback and
35# subsequently restore them.
36allow installd rollback_data_file:dir create_dir_perms;
37allow installd rollback_data_file:file create_file_perms;
38
39# Allow installd to access the runtime feature flag properties.
40get_prop(installd, device_config_runtime_native_prop)
41get_prop(installd, device_config_runtime_native_boot_prop)
42
43# Allow installd to delete files in /data/staging
44allow installd staging_data_file:file unlink;
45allow installd staging_data_file:dir { open read remove_name rmdir search write };
46