tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/vendor/hal_rebootescrow_default.te

11 lines
463 B
Text
Raw Normal View History

Support Resume on Reboot When an OTA is downloaded, the RecoverySystem can be triggered to store the user's lock screen knowledge factor in a secure way using the IRebootEscrow HAL. This will allow the credential encrypted (CE) storage, keymaster credentials, and possibly others to be unlocked when the device reboots after an OTA. Bug: 63928581 Test: make Test: boot emulator with default implementation Test: boot Pixel 4 with default implementation Change-Id: I1f02e7a502478715fd642049da01eb0c01d112f6
2019-12-04 01:55:43 +01:00
type hal_rebootescrow_default, domain;
hal_server_domain(hal_rebootescrow_default, hal_rebootescrow)
rebootescrow: allow use of block file pmem uses a block file while access_ramoops uses a char file. Allow both for now until we can unify on pmem. Additionally allow the reading of vendor properties so it can read the path to the character or block device to open. Test: atest VtsHalRebootEscrowTargetTest Bug: 146400078 Change-Id: Ief61534e0946480a01c635ce1672579959ec8db5
2020-01-25 01:31:58 +01:00
get_prop(hal_rebootescrow_default, rebootescrow_hal_prop);
Support Resume on Reboot When an OTA is downloaded, the RecoverySystem can be triggered to store the user's lock screen knowledge factor in a secure way using the IRebootEscrow HAL. This will allow the credential encrypted (CE) storage, keymaster credentials, and possibly others to be unlocked when the device reboots after an OTA. Bug: 63928581 Test: make Test: boot emulator with default implementation Test: boot Pixel 4 with default implementation Change-Id: I1f02e7a502478715fd642049da01eb0c01d112f6
2019-12-04 01:55:43 +01:00
type hal_rebootescrow_default_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(hal_rebootescrow_default)
Add device file for Resume on Reboot This adds the type and permissions for the default implementation to talk to its kernel module. Bug: 63928581 Test: boot Pixel 4 with default implementation Change-Id: Ie847e4db975b95e90ea64937401e8d8a8ed812cb
2019-12-18 19:38:12 +01:00
type rebootescrow_device, dev_type;
rebootescrow: allow use of block file pmem uses a block file while access_ramoops uses a char file. Allow both for now until we can unify on pmem. Additionally allow the reading of vendor properties so it can read the path to the character or block device to open. Test: atest VtsHalRebootEscrowTargetTest Bug: 146400078 Change-Id: Ief61534e0946480a01c635ce1672579959ec8db5
2020-01-25 01:31:58 +01:00
allow hal_rebootescrow_default rebootescrow_device:{ chr_file blk_file } rw_file_perms;
allow hal_rebootescrow_default block_device:dir search;
Reference in a new issue Copy permalink