From 58dfef56b4dee380c21dbf15a04ff4f034016612 Mon Sep 17 00:00:00 2001 From: Himanshu Agrawal Date: Tue, 16 Mar 2021 12:07:45 +0530 Subject: [PATCH] sepolicy: msm8937: Add selinux rules for update engine Change-Id: I8ba1ca16083613445b7642f83fdccc73a252f658 --- legacy/vendor/msm8937/update_engine_common.te | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 legacy/vendor/msm8937/update_engine_common.te diff --git a/legacy/vendor/msm8937/update_engine_common.te b/legacy/vendor/msm8937/update_engine_common.te new file mode 100644 index 00000000..51f9bea9 --- /dev/null +++ b/legacy/vendor/msm8937/update_engine_common.te @@ -0,0 +1,48 @@ +# Copyright (c) 2017, 2021, The Linux Foundation. All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions are +# met: +# * Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# * Redistributions in binary form must reproduce the above +# copyright notice, this list of conditions and the following +# disclaimer in the documentation and/or other materials provided +# with the distribution. +# * Neither the name of The Linux Foundation nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED +# WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT +# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS +# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF +# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR +# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, +# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE +# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN +# IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +# Allow update_engine and update_engine_sideload (recovery) read/write on the +# device-specific partitions it should update. +allow update_engine_common { + custom_ab_block_device + xbl_block_device + ssd_device + modem_block_device + root_block_device + system_block_device + boot_block_device + mdtp_device + recovery_block_device +}:blk_file rw_file_perms; + +allow update_engine_common tmpfs:lnk_file r_file_perms; +allow update_engine_common metadata_file:dir search; +allow update_engine_common {adsprpcd_file firmware_file}:dir search; +allow update_engine_common {bt_firmware_file firmware_file}:filesystem getattr; + +dontaudit update_engine_common self:capability {dac_read_search dac_override}; +