From a8e073cde0e7d39ebe5d97de497edf22713d3501 Mon Sep 17 00:00:00 2001 From: Nick Kralevich Date: Fri, 27 Feb 2015 17:39:09 -0800 Subject: [PATCH] Create boot_block_device and allow install_recovery read access The install_recovery script creates a new recovery image based off of the boot image plus a patch on /system. We need to allow read access to the boot image to allow the patching to succeed, otherwise OTAs are broken. Addresses the following denial: type=1400 audit(9109404.519:6): avc: denied { read } for pid=341 comm="applypatch" name="mmcblk0p37" dev="tmpfs" ino=9186 scontext=u:r:install_recovery:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=0 TODO: Add device specific labels for the boot image. Bug: 19534538 Change-Id: Ic811ec03e235df3b1bfca9b0a65e23307cd968aa --- device.te | 3 +++ install_recovery.te | 3 ++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/device.te b/device.te index 9ff30d5bc..c155fcced 100644 --- a/device.te +++ b/device.te @@ -76,6 +76,9 @@ type system_block_device, dev_type; # Recovery block device. type recovery_block_device, dev_type; +# boot block device. +type boot_block_device, dev_type; + # Userdata block device mounted on /data. type userdata_block_device, dev_type; diff --git a/install_recovery.te b/install_recovery.te index 9155a2d41..138522036 100644 --- a/install_recovery.te +++ b/install_recovery.te @@ -13,8 +13,9 @@ allow install_recovery shell_exec:file rx_file_perms; # Execute /system/bin/applypatch allow install_recovery system_file:file rx_file_perms; -# Update the recovery block device +# Update the recovery block device based off a diff of the boot block device allow install_recovery block_device:dir search; +allow install_recovery boot_block_device:blk_file r_file_perms; allow install_recovery recovery_block_device:blk_file rw_file_perms; # Create and delete /cache/saved.file