Add rules for calling ReadDefaultFstab()

Grant ReadDefaultFstab() callers
  allow scontext { metadata_file gsi_metadata_file_type }:dir search;
  allow scontext gsi_public_metadata_file:file r_file_perms;
so they can search / read DSU metadata files.
The DSU metadata files are required to deduce the correct fstab.

Also tighten the neverallow rules in gsid.te.

Bug: 181110285
Test: Build pass, presubmit test
Test: Boot and check avc denials
Test: Boot with DSU and check avc denials
Change-Id: Ie464b9a8f7a89f9cf8f4e217dad1322ba3ad0633

private/gsid.te

@@ -166,8 +166,6 @@ neverallow {
     -init
     -gsid
     -fastbootd
-    -recovery
-    -vold
 } gsi_metadata_file_type:dir no_w_dir_perms;
 
 neverallow {
@@ -175,7 +173,6 @@ neverallow {
     -init
     -gsid
     -fastbootd
-    -vold
 } { gsi_metadata_file_type -gsi_public_metadata_file }:file_class_set *;
 
 neverallow {
@@ -183,7 +180,6 @@ neverallow {
     -init
     -gsid
     -fastbootd
-    -vold
 } gsi_public_metadata_file:file_class_set ~{ r_file_perms };
 
 # Prevent apps from accessing gsi_metadata_file_type.
@@ -193,15 +189,7 @@ neverallow {
     domain
     -init
     -gsid
-} gsi_data_file:dir *;
+} gsi_data_file:dir_file_class_set *;
-
-neverallow {
-    domain
-    -init
-    -gsid
-    -fastbootd
-    -vold
-} gsi_data_file:file_class_set *;
 
 neverallow {
     domain

private/lpdumpd.te

@@ -16,12 +16,7 @@ allow lpdumpd super_block_device_type:blk_file r_file_perms;
 # Allow lpdumpd to read fstab.
 allow lpdumpd sysfs_dt_firmware_android:dir r_dir_perms;
 allow lpdumpd sysfs_dt_firmware_android:file r_file_perms;
-
+read_fstab(lpdumpd)
-# Triggered when lpdumpd tries to read default fstab.
-dontaudit lpdumpd metadata_file:dir r_dir_perms;
-dontaudit lpdumpd metadata_file:file r_file_perms;
-dontaudit lpdumpd gsi_metadata_file_type:dir r_dir_perms;
-dontaudit lpdumpd gsi_metadata_file_type:file r_file_perms;
 
 ### Neverallow rules
 

public/uncrypt.te

@@ -38,6 +38,5 @@ allow uncrypt proc_cmdline:file r_file_perms;
 # Read files in /sys
 r_dir_file(uncrypt, sysfs_dt_firmware_android)
 
-# Suppress the denials coming from ReadDefaultFstab call.
+# Allow ReadDefaultFstab().
-dontaudit uncrypt gsi_metadata_file_type:dir search;
+read_fstab(uncrypt)
-dontaudit uncrypt metadata_file:dir search;

public/update_engine.te

@@ -64,12 +64,11 @@ allow update_engine proc_misc:file r_file_perms;
 # read directories on /system and /vendor
 allow update_engine system_file:dir r_dir_perms;
 
+# Allow ReadDefaultFstab().
 # update_engine tries to determine the parent path for all devices (e.g.
 # /dev/block/by-name) by reading the default fstab and looking for the misc
-# device. ReadDefaultFstab() checks whether a GSI is running by checking
+# device.
-# gsi_metadata_file. We never apply OTAs when GSI is running, so just deny
+read_fstab(update_engine)
-# the access.
-dontaudit update_engine gsi_metadata_file_type:dir search;
 
 # Allow to write to snapshotctl_log logs.
 # TODO(b/148818798) revert when parent bug is fixed.

public/vendor_misc_writer.te

@@ -8,8 +8,9 @@ allow vendor_misc_writer block_device:dir r_dir_perms;
 
 # Silence the denial when calling libfstab's ReadDefaultFstab, which tries to
 # load DT fstab.
-dontaudit vendor_misc_writer gsi_metadata_file_type:dir search;
 dontaudit vendor_misc_writer proc_cmdline:file r_file_perms;
-dontaudit vendor_misc_writer metadata_file:dir search;
 dontaudit vendor_misc_writer sysfs_dt_firmware_android:dir search;
 dontaudit vendor_misc_writer proc_bootconfig:file r_file_perms;
+
+# Allow ReadDefaultFstab().
+read_fstab(vendor_misc_writer)

public/vold.te

@@ -293,9 +293,8 @@ allow vold mnt_vendor_file:dir search;
 
 dontaudit vold self:global_capability_class_set sys_resource;
 
-# vold needs to know whether we're running a GSI.
+# Allow ReadDefaultFstab().
-allow vold gsi_metadata_file_type:dir r_dir_perms;
+read_fstab(vold)
-allow vold gsi_metadata_file_type:file r_file_perms;
 
 # vold might need to search loopback apex files
 allow vold vendor_apex_file:file r_file_perms;

vendor/hal_bootctl_default.te

@@ -9,10 +9,7 @@ init_daemon_domain(hal_bootctl_default)
 allow hal_bootctl_default proc_cmdline:file r_file_perms;
 allow hal_bootctl_default sysfs_dt_firmware_android:dir search;
 allow hal_bootctl_default sysfs_dt_firmware_android:file r_file_perms;
-
+read_fstab(hal_bootctl_default)
-# ReadDefaultFstab looks for /metadata/gsi/booted. We don't care about getting
-# a GSI-corrected fstab.
-dontaudit hal_bootctl_default metadata_file:dir search;
 
 # Needed for reading/writing misc partition.
 allow hal_bootctl_default block_device:dir search;