tree 9641ad6fada2494984f3372acb73904892668daf
parent a2f1335819191a0ab29aa79d343ddf7376495af3
author Jiyong Park <jiyong@google.com> 1503898969 +0900
committer Jiyong Park <jiyong@google.com> 1504147923 +0900

Make default namespace for system processes isolated

The default namespace for system process now becomes isolated, which
means it can load only the libs that are in search.paths and under
permitted.paths.

/system/framework, /system/app, /system/priv-app, /vendor/app, /data,
etc are added to the permitted paths since libart should be able to
dlopen odex files under the locations.

Following directories become unavailable:
/system/lib/vndk
/system/lib/vndk-sp

Bug: 37013858
Bug: 64888291
Bug: 64950640
Test: 2017 pixel devices builds and boots
Test: android.jni.cts.JniStaticTest#test_linker_namespaces passes
Change-Id: I2bbe9cc19940c3633c2fb901f9bf8ab813e38c13