tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Allow fs-verity setup within system_server"

Browse source
This commit is contained in:
Treehugger Robot 2019-01-12 06:03:26 +00:00 committed by Gerrit Code Review
commit 9c654b7ca1
3 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
private/system_server.te
View file

@ -789,6 +789,13 @@ allow system_server adbd:unix_stream_socket { getattr getopt ioctl read write sh
# Allow invoking tools like "timeout"
allow system_server toolbox_exec:file rx_file_perms;
# Allow system process to setup and measure fs-verity
allowxperm system_server apk_data_file:file ioctl {
FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY
};
# Allow system process to access the keyring.
allow system_server kernel:key search;
# Postinstall
#
# For OTA dexopt, allow calls coming from postinstall.

7
public/installd.te
View file

@ -13,10 +13,11 @@ allow installd apk_data_file:dir { create_dir_perms relabelfrom };
allow installd apk_data_file:file { create_file_perms relabelfrom link };
allow installd apk_data_file:lnk_file { create r_file_perms unlink };
# FS_IOC_ENABLE_VERITY and FS_IOC_SET_VERITY_MEASUREMENT ioctls
# on APKs in /data/app, to support fsverity
# FS_IOC_ENABLE_VERITY and FS_IOC_MEASURE_VERITY (or in old implementation used in installd,
# FS_IOC_SET_VERITY_MEASUREMENT) ioctls on APKs in /data/app, to support fsverity.
# TODO(b/120629632): this path is deprecated, remove when possible.
allowxperm installd apk_data_file:file ioctl {
FS_IOC_ENABLE_VERITY FS_IOC_SET_VERITY_MEASUREMENT
FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY
};
allow installd asec_apk_file:file r_file_perms;

2
public/ioctl_defines
View file

@ -807,8 +807,8 @@ define(`FS_IOC_GET_ENCRYPTION_POLICY', `0x400c6615')
define(`FS_IOC_GET_ENCRYPTION_PWSALT', `0x40106614')
define(`FS_IOC_GETFLAGS', `0x80086601')
define(`FS_IOC_GETVERSION', `0x80087601')
define(`FS_IOC_MEASURE_VERITY', `0x6686')
define(`FS_IOC_SET_ENCRYPTION_POLICY', `0x800c6613')
define(`FS_IOC_SET_VERITY_MEASUREMENT', `0x6686')
define(`FS_IOC_SETFLAGS', `0x40086602')
define(`FS_IOC_SETVERSION', `0x40087602')
define(`FSL_HV_IOCTL_DOORBELL', `0xc008af06')