Fix dex2oat wrapper SELinux check on Android 14+

[pbzin]

Summary

• detect the Android 14+ artd to dex2oat_exec transition when selecting the wrapper file context
• keep the existing dex2oat execute_no_trans check for Android versions before 14

Root cause

Android 14 introduced the artd service path for dex2oat. The previous check queried dex2oat with execute_no_trans; on Android 16 this check fails because the supported path is the artd -> dex2oat_exec -> dex2oat domain transition. Vector therefore selected the xposed_file fallback for its bind-mounted wrapper. artd then failed to execute the wrapper because the module policy only grants xposed_file access to the older domains.

The fix uses the platform transition already defined by AOSP, so it does not broaden the module policy with an artd access rule for xposed_file.

Validation

• Reproduced on a Redmi Note 13 4G running an Android 16 user build: the old path mounted dex2oat64 with xposed_file, and artd logged Permission denied.
• Confirmed the installed AOSP Android 16 policy defines domain_auto_trans(artd, dex2oat_exec, dex2oat).
• git diff --check passes.
• No full build was run.

[JingMatrix]

@pbzin Please upload your logs in Redmi Note 13 4G for me to better understand what you described.

[pbzin]

@pbzin Please upload your logs in Redmi Note 13 4G for me to better understand what you described.

avc: denied { execute }
avc: denied { execute_no_trans }
scontext=u:r:untrusted_app:s0
tcontext=u:object_r:dex2oat_exec:s0

LSPosedService: failed to change feature flags
ClassNotFoundException: android.app.FeatureFlagsImpl
SQLiteException: no such table: assignment

No IPC binder obtained ... Skipping injection

[JingMatrix]

@pbzin Please upload the original logs, not the filtered one.

[pbzin]

@pbzinPor favor, envie os registros originais, não a versão filtrada.

I'm trying to reproduce it again and for some reason it doesn't give me the error, I messed around a lot with my crdroid rom so it could be that or magisk, I don't know, so the only explanation and log I can find is the previous one with codex and below with gemini, maybe it will help

Technical Context:

On Android 14+ (SDK 34+), AOSP refactored dex2oat invocations to go through the artd daemon, establishing the domain transition artd -> dex2oat_exec -> dex2oat.

In the legacy code, canUseDex2OatExec() checks:

kotlin

SELinux.checkSELinuxAccess("u:r:dex2oat:s0", "u:object_r:dex2oat_exec:s0", "file", "execute_no_trans")
Why it fails on stock Android 14+ / AOSP builds: Since AOSP removed execute_no_trans for the legacy dex2oat domain on Android 14+, checkSELinuxAccess() returns false. This forces Vector into the fallback path:

kotlin

SELinux.setFileContext(WRAPPER, xposedFile)
artd is not granted access to xposed_file, resulting in an SELinux denial (avc: denied { execute }) when artd attempts to launch the bind-mounted wrapper.

Why it might pass on some devices/custom setups: If a custom ROM or root solution (Magisk/KernelSU sepolicy patches) injects permissive rules or relaxes legacy dex2oat access, checkSELinuxAccess may evaluate to true, hiding the bug. However, on pure AOSP or strict OEM policies (Android 14–16), it consistently breaks.

Solution in this PR: Check the current AOSP-defined domain transition for Android 14+ (u:r:artd:s0 -> u:object_r:dex2oat_exec:s0 with execute), ensuring the wrapper is always labeled with dex2oat_exec without relying on legacy fallback rules.