From 1e17dafc6d6b18b963913e8a4082ae1d2c3c47ac Mon Sep 17 00:00:00 2001 From: Tao Bao Date: Wed, 22 Jun 2016 12:16:47 -0700 Subject: [PATCH] update_verifier: Allow searching /dev/block. update_verifier calls bootcontrol HAL to mark the currently booting slot as successfully booted. avc: denied { search } for name="block" dev="tmpfs" scontext=u:r:update_verifier:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=0 avc: denied { search } for name="block" dev="tmpfs" scontext=u:r:update_verifier:s0 tcontext=u:object_r:block_device:s0 tclass=dir permissive=0 Bug: 29569601 Test: Device boots up with no update_verifier denials and 'bootctl is-slot-marked-successful 0' returns 0. Change-Id: I1baa7819bc829e3c4b83d7168008a5b06b01cc9f --- update_verifier.te | 3 +++ 1 file changed, 3 insertions(+) diff --git a/update_verifier.te b/update_verifier.te index 65438d342..d42c81fc2 100644 --- a/update_verifier.te +++ b/update_verifier.te @@ -5,4 +5,7 @@ type update_verifier_exec, exec_type, file_type; init_daemon_domain(update_verifier) +# Allow update_verifier to reach block devices in /dev/block. +allow update_verifier block_device:dir search; + # TODO: Add rules to allow update_verifier to read system_block_device.