tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Create boot_block_device and allow install_recovery read access

Browse source 
The install_recovery script creates a new recovery image based
off of the boot image plus a patch on /system. We need to allow
read access to the boot image to allow the patching to succeed,
otherwise OTAs are broken.

Addresses the following denial:

  type=1400 audit(9109404.519:6): avc: denied { read } for pid=341 comm="applypatch" name="mmcblk0p37" dev="tmpfs" ino=9186 scontext=u:r:install_recovery:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=0

TODO: Add device specific labels for the boot image.

Bug: 19534538
Change-Id: Ic811ec03e235df3b1bfca9b0a65e23307cd968aa
This commit is contained in:
Nick Kralevich 2015-02-27 17:39:09 -08:00
parent 543faccc62
commit a8e073cde0
2 changed files with 5 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
device.te
View file

@ -76,6 +76,9 @@ type system_block_device, dev_type;
# Recovery block device. # Recovery block device.
type recovery_block_device, dev_type; type recovery_block_device, dev_type;
# boot block device.
type boot_block_device, dev_type;
# Userdata block device mounted on /data. # Userdata block device mounted on /data.
type userdata_block_device, dev_type; type userdata_block_device, dev_type;

3
install_recovery.te
View file

@ -13,8 +13,9 @@ allow install_recovery shell_exec:file rx_file_perms;
# Execute /system/bin/applypatch # Execute /system/bin/applypatch
allow install_recovery system_file:file rx_file_perms; allow install_recovery system_file:file rx_file_perms;
# Update the recovery block device # Update the recovery block device based off a diff of the boot block device
allow install_recovery block_device:dir search; allow install_recovery block_device:dir search;
allow install_recovery boot_block_device:blk_file r_file_perms;
allow install_recovery recovery_block_device:blk_file rw_file_perms; allow install_recovery recovery_block_device:blk_file rw_file_perms;
# Create and delete /cache/saved.file # Create and delete /cache/saved.file