platform_system_sepolicy/private/update_engine.te

typeattribute update_engine coredomain;

init_daemon_domain(update_engine);

# Allow to talk to gsid.
allow update_engine gsi_service:service_manager find;
binder_call(update_engine, gsid)

# Allow to start gsid service.
set_prop(update_engine, ctl_gsid_prop)

# Allow to set the OTA related properties, e.g. ota.warm_reset.
set_prop(update_engine, ota_prop)

# Allow to get the DSU status
get_prop(update_engine, gsid_prop)

# Allow update_engine to call the callback function provided by GKI update hook.
binder_call(update_engine, gki_apex_prepostinstall)
Vendor domains must not use Binder On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor apps) are not permitted to use Binder. This commit thus: * groups non-vendor domains using the new "coredomain" attribute, * adds neverallow rules restricting Binder use to coredomain and appdomain only, and * temporarily exempts the domains which are currently violating this rule from this restriction. These domains are grouped using the new "binder_in_vendor_violators" attribute. The attribute is needed because the types corresponding to violators are not exposed to the public policy where the neverallow rules are. Test: mmm system/sepolicy Test: Device boots, no new denials Test: In Chrome, navigate to ip6.me, play a YouTube video Test: YouTube: play a video Test: Netflix: play a movie Test: Google Camera: take a photo, take an HDR+ photo, record video with sound, record slow motion video with sound. Confirm videos play back fine and with sound. Bug: 35870313 Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95 2017-03-23 22:27:32 +01:00			`typeattribute update_engine coredomain;`

Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c 2016-07-22 22:13:11 +02:00			`init_daemon_domain(update_engine);`
update_engine: rules to apply virtual A/B OTA - /data/gsi/ota/* now has the type ota_image_data_file. At runtime during an OTA, update_engine uses libsnapshot to talk to gsid to create these images as a backing storage of snapshots. These "COW images" stores the changes update_engine has applied to the partitions. If the update is successful, these changes will be merged to the partitions, and these images will be teared down. If the update fails, these images will be deleted after rolling back to the previous slot. - /metadata/gsi/ota/* now has the type ota_metadata_file. At runtime during an OTA, update_engine and gsid stores update states and information of the created snapshots there. At next boot, init reads these files to re-create the snapshots. Beside these assignments, this CL also allows gsid and update_engine to have the these permissions to do these operations. Bug: 135752105 Test: apply OTA, no failure Change-Id: Ibd53cacb6b4ee569c33cffbc18b1b801b62265de 2019-08-07 22:01:15 +02:00
			`# Allow to talk to gsid.`
			`allow update_engine gsi_service:service_manager find;`
			`binder_call(update_engine, gsid)`
Move system property rules to private public/property split is landed to selectively export public types to vendors. So rules happening within system should be in private. This introduces private/property.te and moves all allow and neverallow rules from any coredomains to system defiend properties. Bug: 150331497 Test: system/sepolicy/tools/build_policies.sh Change-Id: I0d929024ae9f4ae3830d4bf3d59e999febb22cbe Merged-In: I0d929024ae9f4ae3830d4bf3d59e999febb22cbe (cherry picked from commit 42c7d8966cc5f76c84c001c5af787cbfade736c8) 2020-03-04 09:20:35 +01:00
			`# Allow to start gsid service.`
			`set_prop(update_engine, ctl_gsid_prop)`

			`# Allow to set the OTA related properties, e.g. ota.warm_reset.`
			`set_prop(update_engine, ota_prop)`
Allow update_engine to get gsid property Allow the update_engine to use the gsid property and to avoid the VAB merge when running a DSU. Bug:147071959 Test: ota_e2etest.py Change-Id: I40220877625453198b217e788e6b3bfab8437f24 2020-04-30 11:45:45 +02:00
			`# Allow to get the DSU status`
			`get_prop(update_engine, gsid_prop)`
Support GKI updates Adds proper file_contexts and domains for pre/postinstall hooks. Allow the pre/postinstall hooks to communicate with update_engine stable service. Bug: 161563386 Test: apply a GKI update Change-Id: I4437aab8e87ccbe55858150b95f67ec6e445ac1f 2020-06-02 00:07:50 +02:00
			`# Allow update_engine to call the callback function provided by GKI update hook.`
			`binder_call(update_engine, gki_apex_prepostinstall)`