1# idmap, when executed by installd
2type idmap, domain;
3type idmap_exec, system_file_type, exec_type, file_type;
4
5# TODO remove /system/bin/idmap and the link between idmap and installd (b/118711077)
6# Use open file to /data/resource-cache file inherited from installd.
7allow idmap installd:fd use;
8allow idmap resourcecache_data_file:file create_file_perms;
9allow idmap resourcecache_data_file:dir rw_dir_perms;
10
11# Ignore reading /proc/<pid>/maps after a fork.
12dontaudit idmap installd:file read;
13
14# Open and read from target and overlay apk files passed by argument.
15allow idmap apk_data_file:file r_file_perms;
16allow idmap apk_data_file:dir search;
17
18# Allow /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
19allow idmap { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
20allow idmap { apk_tmp_file apk_private_tmp_file }:dir search;
21
22# Allow apps access to /vendor/app
23r_dir_file(idmap, vendor_app_file)
24
25# Allow apps access to /vendor/overlay
26r_dir_file(idmap, vendor_overlay_file)
27
28# Allow the idmap2d binary to register as a service and communicate via AIDL
29binder_use(idmap)
30binder_service(idmap)
31add_service(idmap, idmap_service)
32