Snap for 7783058 from c2872fa4275e06224164986525c0157c117773dc to sc-v2-releaseandroid-vts-12.1_r9android-vts-12.1_r8android-vts-12.1_r7android-vts-12.1_r6android-vts-12.1_r5android-vts-12.1_r4android-vts-12.1_r3android-vts-12.1_r2android-vts-12.1_r10android-vts-12.1_r1android-platform-12.1.0_r9android-platform-12.1.0_r8android-platform-12.1.0_r7android-platform-12.1.0_r6android-platform-12.1.0_r5android-platform-12.1.0_r4android-platform-12.1.0_r3android-platform-12.1.0_r27android-platform-12.1.0_r26android-platform-12.1.0_r25android-platform-12.1.0_r24android-platform-12.1.0_r23android-platform-12.1.0_r22android-platform-12.1.0_r21android-platform-12.1.0_r20android-platform-12.1.0_r2android-platform-12.1.0_r19android-platform-12.1.0_r18android-platform-12.1.0_r17android-platform-12.1.0_r16android-platform-12.1.0_r15android-platform-12.1.0_r14android-platform-12.1.0_r13android-platform-12.1.0_r12android-platform-12.1.0_r11android-platform-12.1.0_r10android-platform-12.1.0_r1android-cts-12.1_r9android-cts-12.1_r8android-cts-12.1_r7android-cts-12.1_r6android-cts-12.1_r5android-cts-12.1_r4android-cts-12.1_r3android-cts-12.1_r2android-cts-12.1_r10android-cts-12.1_r1android-12.1.0_r6android-12.1.0_r5android-12.1.0_r4android-12.1.0_r3android-12.1.0_r27android-12.1.0_r2android-12.1.0_r1android12L-tests-releaseandroid12L-s1-releaseandroid12L-releaseandroid12L-platform-releaseandroid12L-gsi

Change-Id: If42a197e3ab3b4fd0a3eb855aaa6a9886ff02581

6 files changed, 112 insertions, 13 deletions

diff --git a/contents/namespace/vndk.cc b/contents/namespace/vndk.cc
index 556dfed..36540c4 100644
--- a/contents/namespace/vndk.cc
+++ b/contents/namespace/vndk.cc
@@ -43,12 +43,12 @@ Namespace BuildVndkNamespace([[maybe_unused]] const Context& ctx,
     name = "vndk";
   }
 
-  // Isolated but visible when used in the [system] or [unrestricted] section to
+  // Isolated and visible when used in the [system] or [unrestricted] section to
   // allow links to be created at runtime, e.g. through android_link_namespaces
-  // in libnativeloader. Otherwise it isn't isolated, so visibility doesn't
-  // matter.
+  // in libnativeloader. Otherwise namespace should be isolated but not visible
+  // so namespace itself keep strict and links would not be modified at runtime.
   Namespace ns(name,
-               /*is_isolated=*/ctx.IsSystemSection() || ctx.IsApexBinaryConfig(),
+               /*is_isolated=*/true,
                /*is_visible=*/is_system_or_unrestricted_section);
 
   std::vector<std::string> lib_paths;
@@ -78,8 +78,7 @@ Namespace BuildVndkNamespace([[maybe_unused]] const Context& ctx,
   // 2. VNDK APEX
   ns.AddSearchPath("/apex/com.android.vndk.v" + vndk_version + "/${LIB}");
 
-  if (is_system_or_unrestricted_section &&
-      vndk_user == VndkUserPartition::Vendor) {
+  if (vndk_user == VndkUserPartition::Vendor) {
     // It is for vendor sp-hal
     ns.AddPermittedPath("/odm/${LIB}/hw");
     ns.AddPermittedPath("/odm/${LIB}/egl");
diff --git a/testdata/golden_output/product-enabled/com.vendor.service1/ld.config.txt b/testdata/golden_output/product-enabled/com.vendor.service1/ld.config.txt
index 6d0edc9..70d8596 100644
--- a/testdata/golden_output/product-enabled/com.vendor.service1/ld.config.txt
+++ b/testdata/golden_output/product-enabled/com.vendor.service1/ld.config.txt
@@ -304,6 +304,13 @@ namespace.vndk.search.paths += /vendor/${LIB}/vndk
 namespace.vndk.search.paths += /apex/com.android.vndk.vR/${LIB}
 namespace.vndk.search.paths += /odm/${LIB}
 namespace.vndk.search.paths += /vendor/${LIB}
+namespace.vndk.permitted.paths = /odm/${LIB}/hw
+namespace.vndk.permitted.paths += /odm/${LIB}/egl
+namespace.vndk.permitted.paths += /vendor/${LIB}/hw
+namespace.vndk.permitted.paths += /vendor/${LIB}/egl
+namespace.vndk.permitted.paths += /system/vendor/${LIB}/hw
+namespace.vndk.permitted.paths += /system/vendor/${LIB}/egl
+namespace.vndk.permitted.paths += /apex/com.android.vndk.vR/${LIB}/hw
 namespace.vndk.asan.search.paths = /data/asan/odm/${LIB}/vndk-sp
 namespace.vndk.asan.search.paths += /odm/${LIB}/vndk-sp
 namespace.vndk.asan.search.paths += /data/asan/odm/${LIB}/vndk
@@ -317,6 +324,19 @@ namespace.vndk.asan.search.paths += /data/asan/odm/${LIB}
 namespace.vndk.asan.search.paths += /odm/${LIB}
 namespace.vndk.asan.search.paths += /data/asan/vendor/${LIB}
 namespace.vndk.asan.search.paths += /vendor/${LIB}
+namespace.vndk.asan.permitted.paths = /data/asan/odm/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /odm/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/odm/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /odm/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /data/asan/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /data/asan/system/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /system/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/system/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /system/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /apex/com.android.vndk.vR/${LIB}/hw
 namespace.vndk.links = system,com_android_neuralnetworks
 namespace.vndk.link.system.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libbinder_ndk.so:libc.so:libcgrouprc.so:libclang_rt.asan-i686-android.so:libdl.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
 namespace.vndk.link.system.shared_libs += libc.so
diff --git a/testdata/golden_output/product-enabled/ld.config.txt b/testdata/golden_output/product-enabled/ld.config.txt
index 88ccb85..9b337c6 100644
--- a/testdata/golden_output/product-enabled/ld.config.txt
+++ b/testdata/golden_output/product-enabled/ld.config.txt
@@ -786,7 +786,7 @@ namespace.system.link.com_android_resolv.shared_libs = libnetd_resolv.so
 namespace.system.link.com_android_neuralnetworks.shared_libs = libneuralnetworks.so
 namespace.system.link.com_android_os_statsd.shared_libs = libstatspull.so
 namespace.system.link.com_android_os_statsd.shared_libs += libstatssocket.so
-namespace.vndk.isolated = false
+namespace.vndk.isolated = true
 namespace.vndk.search.paths = /odm/${LIB}/vndk-sp
 namespace.vndk.search.paths += /odm/${LIB}/vndk
 namespace.vndk.search.paths += /vendor/${LIB}/vndk-sp
@@ -794,6 +794,13 @@ namespace.vndk.search.paths += /vendor/${LIB}/vndk
 namespace.vndk.search.paths += /apex/com.android.vndk.vR/${LIB}
 namespace.vndk.search.paths += /odm/${LIB}
 namespace.vndk.search.paths += /vendor/${LIB}
+namespace.vndk.permitted.paths = /odm/${LIB}/hw
+namespace.vndk.permitted.paths += /odm/${LIB}/egl
+namespace.vndk.permitted.paths += /vendor/${LIB}/hw
+namespace.vndk.permitted.paths += /vendor/${LIB}/egl
+namespace.vndk.permitted.paths += /system/vendor/${LIB}/hw
+namespace.vndk.permitted.paths += /system/vendor/${LIB}/egl
+namespace.vndk.permitted.paths += /apex/com.android.vndk.vR/${LIB}/hw
 namespace.vndk.asan.search.paths = /data/asan/odm/${LIB}/vndk-sp
 namespace.vndk.asan.search.paths += /odm/${LIB}/vndk-sp
 namespace.vndk.asan.search.paths += /data/asan/odm/${LIB}/vndk
@@ -807,6 +814,19 @@ namespace.vndk.asan.search.paths += /data/asan/odm/${LIB}
 namespace.vndk.asan.search.paths += /odm/${LIB}
 namespace.vndk.asan.search.paths += /data/asan/vendor/${LIB}
 namespace.vndk.asan.search.paths += /vendor/${LIB}
+namespace.vndk.asan.permitted.paths = /data/asan/odm/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /odm/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/odm/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /odm/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /data/asan/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /data/asan/system/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /system/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/system/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /system/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /apex/com.android.vndk.vR/${LIB}/hw
 namespace.vndk.links = system,com_android_neuralnetworks
 namespace.vndk.link.system.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libbinder_ndk.so:libc.so:libcgrouprc.so:libclang_rt.asan-i686-android.so:libdl.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
 namespace.vndk.link.system.shared_libs += libc.so
@@ -1111,7 +1131,7 @@ namespace.system.link.com_android_resolv.shared_libs = libnetd_resolv.so
 namespace.system.link.com_android_neuralnetworks.shared_libs = libneuralnetworks.so
 namespace.system.link.com_android_os_statsd.shared_libs = libstatspull.so
 namespace.system.link.com_android_os_statsd.shared_libs += libstatssocket.so
-namespace.vndk.isolated = false
+namespace.vndk.isolated = true
 namespace.vndk.search.paths = /product/${LIB}/vndk-sp
 namespace.vndk.search.paths += /product/${LIB}/vndk
 namespace.vndk.search.paths += /apex/com.android.vndk.vR/${LIB}
@@ -1450,7 +1470,7 @@ namespace.sphal.link.default.shared_libs += libm.so
 namespace.sphal.link.default.shared_libs += libclang_rt.asan-arm-android.so:libclang_rt.asan-i686-android.so:libclang_rt.hwasan-arm-android.so:libclang_rt.hwasan-i686-android.so:libclang_rt.tsan-arm-android.so:libclang_rt.tsan-i686-android.so:libclang_rt.ubsan_standalone-arm-android.so:libclang_rt.ubsan_standalone-i686-android.so
 namespace.sphal.link.vndk.shared_libs = android.hardware.graphics.common@1.0.so:android.hardware.graphics.common@1.1.so:android.hardware.graphics.common@1.2.so:android.hardware.graphics.mapper@2.0.so:android.hardware.graphics.mapper@2.1.so:android.hardware.graphics.mapper@3.0.so:android.hardware.renderscript@1.0.so:android.hidl.memory.token@1.0.so:android.hidl.memory@1.0-impl.so:android.hidl.memory@1.0.so:android.hidl.safe_union@1.0.so:libRSCpuRef.so:libRSDriver.so:libRS_internal.so:libbase.so:libbcinfo.so:libc++.so:libcutils.so:libhardware.so:libhidlbase.so:libhidlmemory.so:libion.so:libjsoncpp.so:liblzma.so:libprocessgroup.so:libunwindstack.so:libutils.so:libutilscallstack.so:libz.so
 namespace.sphal.link.com_android_neuralnetworks.shared_libs = libneuralnetworks.so
-namespace.vndk.isolated = false
+namespace.vndk.isolated = true
 namespace.vndk.visible = true
 namespace.vndk.search.paths = /odm/${LIB}/vndk-sp
 namespace.vndk.search.paths += /vendor/${LIB}/vndk-sp
diff --git a/testdata/golden_output/stage1/ld.config.txt b/testdata/golden_output/stage1/ld.config.txt
index 90f4e37..51c9464 100644
--- a/testdata/golden_output/stage1/ld.config.txt
+++ b/testdata/golden_output/stage1/ld.config.txt
@@ -515,7 +515,7 @@ namespace.system.link.com_android_art.shared_libs += libdexfiled.so
 namespace.system.link.com_android_art.shared_libs += libnativebridge.so
 namespace.system.link.com_android_art.shared_libs += libnativehelper.so
 namespace.system.link.com_android_art.shared_libs += libnativeloader.so
-namespace.vndk.isolated = false
+namespace.vndk.isolated = true
 namespace.vndk.search.paths = /odm/${LIB}/vndk-sp
 namespace.vndk.search.paths += /odm/${LIB}/vndk
 namespace.vndk.search.paths += /vendor/${LIB}/vndk-sp
@@ -523,6 +523,13 @@ namespace.vndk.search.paths += /vendor/${LIB}/vndk
 namespace.vndk.search.paths += /apex/com.android.vndk.vR/${LIB}
 namespace.vndk.search.paths += /odm/${LIB}
 namespace.vndk.search.paths += /vendor/${LIB}
+namespace.vndk.permitted.paths = /odm/${LIB}/hw
+namespace.vndk.permitted.paths += /odm/${LIB}/egl
+namespace.vndk.permitted.paths += /vendor/${LIB}/hw
+namespace.vndk.permitted.paths += /vendor/${LIB}/egl
+namespace.vndk.permitted.paths += /system/vendor/${LIB}/hw
+namespace.vndk.permitted.paths += /system/vendor/${LIB}/egl
+namespace.vndk.permitted.paths += /apex/com.android.vndk.vR/${LIB}/hw
 namespace.vndk.asan.search.paths = /data/asan/odm/${LIB}/vndk-sp
 namespace.vndk.asan.search.paths += /odm/${LIB}/vndk-sp
 namespace.vndk.asan.search.paths += /data/asan/odm/${LIB}/vndk
@@ -536,6 +543,19 @@ namespace.vndk.asan.search.paths += /data/asan/odm/${LIB}
 namespace.vndk.asan.search.paths += /odm/${LIB}
 namespace.vndk.asan.search.paths += /data/asan/vendor/${LIB}
 namespace.vndk.asan.search.paths += /vendor/${LIB}
+namespace.vndk.asan.permitted.paths = /data/asan/odm/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /odm/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/odm/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /odm/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /data/asan/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /data/asan/system/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /system/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/system/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /system/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /apex/com.android.vndk.vR/${LIB}/hw
 namespace.vndk.links = system
 namespace.vndk.link.system.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libbinder_ndk.so:libc.so:libcgrouprc.so:libclang_rt.asan-i686-android.so:libdl.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
 namespace.vndk.link.system.shared_libs += libc.so
@@ -709,7 +729,7 @@ namespace.sphal.link.default.shared_libs += libdl_android.so
 namespace.sphal.link.default.shared_libs += libm.so
 namespace.sphal.link.default.shared_libs += libclang_rt.asan-arm-android.so:libclang_rt.asan-i686-android.so:libclang_rt.hwasan-arm-android.so:libclang_rt.hwasan-i686-android.so:libclang_rt.tsan-arm-android.so:libclang_rt.tsan-i686-android.so:libclang_rt.ubsan_standalone-arm-android.so:libclang_rt.ubsan_standalone-i686-android.so
 namespace.sphal.link.vndk.shared_libs = android.hardware.graphics.common@1.0.so:android.hardware.graphics.common@1.1.so:android.hardware.graphics.common@1.2.so:android.hardware.graphics.mapper@2.0.so:android.hardware.graphics.mapper@2.1.so:android.hardware.graphics.mapper@3.0.so:android.hardware.renderscript@1.0.so:android.hidl.memory.token@1.0.so:android.hidl.memory@1.0-impl.so:android.hidl.memory@1.0.so:android.hidl.safe_union@1.0.so:libRSCpuRef.so:libRSDriver.so:libRS_internal.so:libbase.so:libbcinfo.so:libc++.so:libcutils.so:libhardware.so:libhidlbase.so:libhidlmemory.so:libion.so:libjsoncpp.so:liblzma.so:libprocessgroup.so:libunwindstack.so:libutils.so:libutilscallstack.so:libz.so
-namespace.vndk.isolated = false
+namespace.vndk.isolated = true
 namespace.vndk.visible = true
 namespace.vndk.search.paths = /odm/${LIB}/vndk-sp
 namespace.vndk.search.paths += /vendor/${LIB}/vndk-sp
diff --git a/testdata/golden_output/stage2/com.vendor.service1/ld.config.txt b/testdata/golden_output/stage2/com.vendor.service1/ld.config.txt
index 61afb31..b9f66ce 100644
--- a/testdata/golden_output/stage2/com.vendor.service1/ld.config.txt
+++ b/testdata/golden_output/stage2/com.vendor.service1/ld.config.txt
@@ -310,6 +310,13 @@ namespace.vndk.search.paths += /vendor/${LIB}/vndk
 namespace.vndk.search.paths += /apex/com.android.vndk.vR/${LIB}
 namespace.vndk.search.paths += /odm/${LIB}
 namespace.vndk.search.paths += /vendor/${LIB}
+namespace.vndk.permitted.paths = /odm/${LIB}/hw
+namespace.vndk.permitted.paths += /odm/${LIB}/egl
+namespace.vndk.permitted.paths += /vendor/${LIB}/hw
+namespace.vndk.permitted.paths += /vendor/${LIB}/egl
+namespace.vndk.permitted.paths += /system/vendor/${LIB}/hw
+namespace.vndk.permitted.paths += /system/vendor/${LIB}/egl
+namespace.vndk.permitted.paths += /apex/com.android.vndk.vR/${LIB}/hw
 namespace.vndk.asan.search.paths = /data/asan/odm/${LIB}/vndk-sp
 namespace.vndk.asan.search.paths += /odm/${LIB}/vndk-sp
 namespace.vndk.asan.search.paths += /data/asan/odm/${LIB}/vndk
@@ -323,6 +330,19 @@ namespace.vndk.asan.search.paths += /data/asan/odm/${LIB}
 namespace.vndk.asan.search.paths += /odm/${LIB}
 namespace.vndk.asan.search.paths += /data/asan/vendor/${LIB}
 namespace.vndk.asan.search.paths += /vendor/${LIB}
+namespace.vndk.asan.permitted.paths = /data/asan/odm/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /odm/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/odm/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /odm/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /data/asan/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /data/asan/system/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /system/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/system/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /system/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /apex/com.android.vndk.vR/${LIB}/hw
 namespace.vndk.links = system,com_android_neuralnetworks
 namespace.vndk.link.system.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libbinder_ndk.so:libc.so:libcgrouprc.so:libclang_rt.asan-i686-android.so:libdl.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
 namespace.vndk.link.system.shared_libs += libc.so
diff --git a/testdata/golden_output/stage2/ld.config.txt b/testdata/golden_output/stage2/ld.config.txt
index 1462d3b..a8c6fdb 100644
--- a/testdata/golden_output/stage2/ld.config.txt
+++ b/testdata/golden_output/stage2/ld.config.txt
@@ -780,7 +780,7 @@ namespace.system.link.com_android_resolv.shared_libs = libnetd_resolv.so
 namespace.system.link.com_android_neuralnetworks.shared_libs = libneuralnetworks.so
 namespace.system.link.com_android_os_statsd.shared_libs = libstatspull.so
 namespace.system.link.com_android_os_statsd.shared_libs += libstatssocket.so
-namespace.vndk.isolated = false
+namespace.vndk.isolated = true
 namespace.vndk.search.paths = /odm/${LIB}/vndk-sp
 namespace.vndk.search.paths += /odm/${LIB}/vndk
 namespace.vndk.search.paths += /vendor/${LIB}/vndk-sp
@@ -788,6 +788,13 @@ namespace.vndk.search.paths += /vendor/${LIB}/vndk
 namespace.vndk.search.paths += /apex/com.android.vndk.vR/${LIB}
 namespace.vndk.search.paths += /odm/${LIB}
 namespace.vndk.search.paths += /vendor/${LIB}
+namespace.vndk.permitted.paths = /odm/${LIB}/hw
+namespace.vndk.permitted.paths += /odm/${LIB}/egl
+namespace.vndk.permitted.paths += /vendor/${LIB}/hw
+namespace.vndk.permitted.paths += /vendor/${LIB}/egl
+namespace.vndk.permitted.paths += /system/vendor/${LIB}/hw
+namespace.vndk.permitted.paths += /system/vendor/${LIB}/egl
+namespace.vndk.permitted.paths += /apex/com.android.vndk.vR/${LIB}/hw
 namespace.vndk.asan.search.paths = /data/asan/odm/${LIB}/vndk-sp
 namespace.vndk.asan.search.paths += /odm/${LIB}/vndk-sp
 namespace.vndk.asan.search.paths += /data/asan/odm/${LIB}/vndk
@@ -801,6 +808,19 @@ namespace.vndk.asan.search.paths += /data/asan/odm/${LIB}
 namespace.vndk.asan.search.paths += /odm/${LIB}
 namespace.vndk.asan.search.paths += /data/asan/vendor/${LIB}
 namespace.vndk.asan.search.paths += /vendor/${LIB}
+namespace.vndk.asan.permitted.paths = /data/asan/odm/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /odm/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/odm/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /odm/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /data/asan/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /data/asan/system/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /system/vendor/${LIB}/hw
+namespace.vndk.asan.permitted.paths += /data/asan/system/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /system/vendor/${LIB}/egl
+namespace.vndk.asan.permitted.paths += /apex/com.android.vndk.vR/${LIB}/hw
 namespace.vndk.links = system,com_android_neuralnetworks
 namespace.vndk.link.system.shared_libs = libEGL.so:libGLESv1_CM.so:libGLESv2.so:libGLESv3.so:libRS.so:libandroid_net.so:libbinder_ndk.so:libc.so:libcgrouprc.so:libclang_rt.asan-i686-android.so:libdl.so:liblog.so:libm.so:libmediandk.so:libnativewindow.so:libneuralnetworks.so:libsync.so:libvndksupport.so:libvulkan.so
 namespace.vndk.link.system.shared_libs += libc.so
@@ -1128,7 +1148,7 @@ namespace.sphal.link.default.shared_libs += libm.so
 namespace.sphal.link.default.shared_libs += libclang_rt.asan-arm-android.so:libclang_rt.asan-i686-android.so:libclang_rt.hwasan-arm-android.so:libclang_rt.hwasan-i686-android.so:libclang_rt.tsan-arm-android.so:libclang_rt.tsan-i686-android.so:libclang_rt.ubsan_standalone-arm-android.so:libclang_rt.ubsan_standalone-i686-android.so
 namespace.sphal.link.vndk.shared_libs = android.hardware.graphics.common@1.0.so:android.hardware.graphics.common@1.1.so:android.hardware.graphics.common@1.2.so:android.hardware.graphics.mapper@2.0.so:android.hardware.graphics.mapper@2.1.so:android.hardware.graphics.mapper@3.0.so:android.hardware.renderscript@1.0.so:android.hidl.memory.token@1.0.so:android.hidl.memory@1.0-impl.so:android.hidl.memory@1.0.so:android.hidl.safe_union@1.0.so:libRSCpuRef.so:libRSDriver.so:libRS_internal.so:libbase.so:libbcinfo.so:libc++.so:libcutils.so:libhardware.so:libhidlbase.so:libhidlmemory.so:libion.so:libjsoncpp.so:liblzma.so:libprocessgroup.so:libunwindstack.so:libutils.so:libutilscallstack.so:libz.so
 namespace.sphal.link.com_android_neuralnetworks.shared_libs = libneuralnetworks.so
-namespace.vndk.isolated = false
+namespace.vndk.isolated = true
 namespace.vndk.visible = true
 namespace.vndk.search.paths = /odm/${LIB}/vndk-sp
 namespace.vndk.search.paths += /vendor/${LIB}/vndk-sp