From 6116daa71a226dc848978717064b805272801ff4 Mon Sep 17 00:00:00 2001
From: Andreas Huber <andih@google.com>
Date: Mon, 22 Jan 2018 13:24:10 -0800
Subject: [PATCH] Fingerprint data is now stored in one of two ways depending
 on the

shipping API version:

For devices shipped before Android P nothing changes, data is stored
under /data/system/users/<user-id>/fpdata/...

Devices shipped from now on will instead store fingerprint data under
/data/vendor_de/<user-id>/fpdata.

Support for /data/vendor_de and /data/vendor_ce has been added to vold.

Bug: 36997597
Change-Id: Ibc7cc33b756f64abe68a749c0ada0ca4f6d92514
Test: manually
---
 private/compat/26.0/26.0.ignore.cil | 1 +
 private/file_contexts               | 3 +++
 private/vold_prepare_subdirs.te     | 1 +
 public/domain.te                    | 2 ++
 public/file.te                      | 2 ++
 public/hal_fingerprint.te           | 5 +++++
 public/tee.te                       | 4 ++++
 7 files changed, 18 insertions(+)

diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index 8db5d3455..6db5f1e4c 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -34,6 +34,7 @@
     exported2_vold_prop
     exported3_default_prop
     exported3_system_prop
+    fingerprint_vendor_data_file
     fs_bpf
     hal_broadcastradio_hwservice
     hal_cas_hwservice
diff --git a/private/file_contexts b/private/file_contexts
index 38bcafd81..b3ce24496 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -415,6 +415,9 @@
 # Fingerprint data
 /data/system/users/[0-9]+/fpdata(/.*)? u:object_r:fingerprintd_data_file:s0
 
+# Fingerprint vendor data file
+/data/vendor_de/[0-9]+/fpdata(/.*)? u:object_r:fingerprint_vendor_data_file:s0
+
 # Bootchart data
 /data/bootchart(/.*)?		u:object_r:bootchart_data_file:s0
 
diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te
index 58e510ed8..6acb2ced5 100644
--- a/private/vold_prepare_subdirs.te
+++ b/private/vold_prepare_subdirs.te
@@ -13,3 +13,4 @@ allow vold_prepare_subdirs system_data_file:dir { open read write add_name remov
 allow vold_prepare_subdirs vold_data_file:dir { create open read write search getattr setattr remove_name rmdir };
 allow vold_prepare_subdirs vold_data_file:file { getattr unlink };
 allow vold_prepare_subdirs storaged_data_file:dir create_dir_perms;
+allow vold_prepare_subdirs fingerprint_vendor_data_file:dir create_dir_perms;
diff --git a/public/domain.te b/public/domain.te
index cffe5cdae..71af70214 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -765,6 +765,7 @@ full_treble_only(`
     -data_between_core_and_vendor_violators
     -init
     -vendor_init
+    -vold_prepare_subdirs
   } {
     data_file_type
     -core_data_file_type
@@ -775,6 +776,7 @@ full_treble_only(`
     -data_between_core_and_vendor_violators
     -init
     -vendor_init
+    -vold_prepare_subdirs
     } {
       data_file_type
       -core_data_file_type
diff --git a/public/file.te b/public/file.te
index ca6022d08..7a0fabc9f 100644
--- a/public/file.te
+++ b/public/file.te
@@ -291,6 +291,8 @@ type backup_data_file, file_type, data_file_type, core_data_file_type, mlstruste
 type bluetooth_efs_file, file_type;
 # Type for fingerprint template file
 type fingerprintd_data_file, file_type, data_file_type, core_data_file_type;
+# Type for _new_ fingerprint template file
+type fingerprint_vendor_data_file, file_type, data_file_type;
 # Type for appfuse file.
 type app_fuse_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
 
diff --git a/public/hal_fingerprint.te b/public/hal_fingerprint.te
index 36de76191..ebe0b0c82 100644
--- a/public/hal_fingerprint.te
+++ b/public/hal_fingerprint.te
@@ -8,5 +8,10 @@ allow hal_fingerprint_client hal_fingerprint_hwservice:hwservice_manager find;
 # For memory allocation
 allow hal_fingerprint ion_device:chr_file r_file_perms;
 
+allow hal_fingerprint fingerprint_vendor_data_file:file { create_file_perms };
+allow hal_fingerprint fingerprint_vendor_data_file:dir rw_dir_perms;
+
 r_dir_file(hal_fingerprint, cgroup)
 r_dir_file(hal_fingerprint, sysfs)
+
+
diff --git a/public/tee.te b/public/tee.te
index f023d5c23..0f9b32dc9 100644
--- a/public/tee.te
+++ b/public/tee.te
@@ -5,3 +5,7 @@ type tee, domain;
 
 # Device(s) for communicating with the TEE
 type tee_device, dev_type;
+
+allow tee fingerprint_vendor_data_file:dir rw_dir_perms;
+allow tee fingerprint_vendor_data_file:file create_file_perms;
+