tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Uncrypt: Allow uncrypt to write on ota_package_file." am: 42f9a5337a am: a05c24d464

Browse source 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/1344636

Change-Id: Ie99b25fdab079ef68d7e102c0f7592d6cbb28c95
This commit is contained in:
Paul Crowley 2020-07-07 15:49:50 +00:00 committed by Automerger Merge Worker
commit 93aad35cb1
2 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
prebuilts/api/30.0/public/uncrypt.te
View file

@ -15,9 +15,9 @@ allow uncrypt cache_file:dir search;
allow uncrypt cache_recovery_file:dir rw_dir_perms;
allow uncrypt cache_recovery_file:file create_file_perms;
# Read OTA zip file at /data/ota_package/.
# Read and write(for f2fs_pin_file) on OTA zip file at /data/ota_package/.
allow uncrypt ota_package_file:dir r_dir_perms;
allow uncrypt ota_package_file:file r_file_perms;
allow uncrypt ota_package_file:file rw_file_perms;
# Write to /dev/socket/uncrypt
unix_socket_connect(uncrypt, uncrypt, uncrypt)
@ -40,3 +40,7 @@ allow uncrypt proc_cmdline:file r_file_perms;
# Read files in /sys
r_dir_file(uncrypt, sysfs_dt_firmware_android)
# Suppress the denials coming from ReadDefaultFstab call.
dontaudit uncrypt gsi_metadata_file:dir search;
dontaudit uncrypt metadata_file:dir search;

8
public/uncrypt.te
View file

@ -15,9 +15,9 @@ allow uncrypt cache_file:dir search;
allow uncrypt cache_recovery_file:dir rw_dir_perms;
allow uncrypt cache_recovery_file:file create_file_perms;
# Read OTA zip file at /data/ota_package/.
# Read and write(for f2fs_pin_file) on OTA zip file at /data/ota_package/.
allow uncrypt ota_package_file:dir r_dir_perms;
allow uncrypt ota_package_file:file r_file_perms;
allow uncrypt ota_package_file:file rw_file_perms;
# Write to /dev/socket/uncrypt
unix_socket_connect(uncrypt, uncrypt, uncrypt)
@ -37,3 +37,7 @@ allow uncrypt proc_cmdline:file r_file_perms;
# Read files in /sys
r_dir_file(uncrypt, sysfs_dt_firmware_android)
# Suppress the denials coming from ReadDefaultFstab call.
dontaudit uncrypt gsi_metadata_file:dir search;
dontaudit uncrypt metadata_file:dir search;