From b071882d76e536e0be1a32621f7945cb71cff54b Mon Sep 17 00:00:00 2001 From: Pawan Wagh Date: Mon, 29 Apr 2024 22:03:20 +0000 Subject: [PATCH] Allow system app and update_engine to read OTA from /vendor Introuducing vendor_boot_ota_file which will be used to allow reading OTAs from /vendor/boot_otas when BOARD_16K_OTA_MOVE_VENDOR := true is set. These OTAs will be read from settings app(system_app) and update engine. Test: m, m Settings && adb install -r $ANDROID_PRODUCT_OUT/system_ext/priv-app/Settings/Settings.apk Bug: 335022191 Change-Id: Ie42e0de12694ed74f9a98cd115f72d207f67c834 --- contexts/plat_file_contexts_test | 2 ++ private/compat/202404/202404.cil | 2 +- private/domain.te | 1 + private/file_contexts | 2 ++ private/system_app.te | 3 +++ private/update_engine.te | 3 +++ public/file.te | 5 +++++ 7 files changed, 17 insertions(+), 1 deletion(-) diff --git a/contexts/plat_file_contexts_test b/contexts/plat_file_contexts_test index 6e9a8a28f..232b07368 100644 --- a/contexts/plat_file_contexts_test +++ b/contexts/plat_file_contexts_test @@ -539,6 +539,8 @@ /vendor/priv-app/test vendor_app_file /system/vendor/priv-app vendor_app_file /system/vendor/priv-app/test vendor_app_file +/vendor/boot_otas/ vendor_boot_ota_file +/vendor/boot_otas/test vendor_boot_ota_file /vendor/overlay vendor_overlay_file /vendor/overlay/test vendor_overlay_file /system/vendor/overlay vendor_overlay_file diff --git a/private/compat/202404/202404.cil b/private/compat/202404/202404.cil index 02bbced1c..ca0f4599c 100644 --- a/private/compat/202404/202404.cil +++ b/private/compat/202404/202404.cil @@ -2682,7 +2682,7 @@ (typeattributeset vendor_configs_file_202404 (vendor_configs_file)) (typeattributeset vendor_data_file_202404 (vendor_data_file)) (typeattributeset vendor_default_prop_202404 (vendor_default_prop)) -(typeattributeset vendor_file_202404 (vendor_file)) +(typeattributeset vendor_file_202404 (vendor_file vendor_boot_ota_file)) (typeattributeset vendor_framework_file_202404 (vendor_framework_file)) (typeattributeset vendor_hal_file_202404 (vendor_hal_file)) (typeattributeset vendor_idc_file_202404 (vendor_idc_file)) diff --git a/private/domain.te b/private/domain.te index 60e61a49b..53bcdcf74 100644 --- a/private/domain.te +++ b/private/domain.te @@ -2036,6 +2036,7 @@ full_treble_only(` -vendor_app_file -vendor_apex_file -vendor_apex_metadata_file + -vendor_boot_ota_file -vendor_configs_file -vendor_microdroid_file -vendor_service_contexts_file diff --git a/private/file_contexts b/private/file_contexts index c72d752bc..b82b4f05d 100644 --- a/private/file_contexts +++ b/private/file_contexts @@ -437,6 +437,8 @@ /(vendor|system/vendor)/etc/aconfig(/.*)? u:object_r:vendor_aconfig_storage_file:s0 +/vendor/boot_otas(/.*)? u:object_r:vendor_boot_ota_file:s0 + # HAL location /(vendor|system/vendor)/lib(64)?/hw u:object_r:vendor_hal_file:s0 diff --git a/private/system_app.te b/private/system_app.te index af9d168af..5016a40c7 100644 --- a/private/system_app.te +++ b/private/system_app.te @@ -196,3 +196,6 @@ neverallow system_app shell_data_file:file { open read ioctl lock }; neverallow { domain -init -system_app } adaptive_haptics_prop:property_service set; # system_app should be the only domain writing the force l3 prop neverallow { domain -init -system_app } drm_forcel3_prop:property_service set; + +allow system_app vendor_boot_ota_file:dir { r_dir_perms }; +allow system_app vendor_boot_ota_file:file { r_file_perms }; diff --git a/private/update_engine.te b/private/update_engine.te index 6a6071822..1a6d9c777 100644 --- a/private/update_engine.te +++ b/private/update_engine.te @@ -115,3 +115,6 @@ allow update_engine snapshotctl_log_data_file:file create_file_perms; # Allow determining filesystems available on system. # Needed for checking if overlayfs is enabled allow update_engine proc_filesystems:file r_file_perms; + +allow update_engine vendor_boot_ota_file:dir { r_dir_perms }; +allow update_engine vendor_boot_ota_file:file { r_file_perms }; diff --git a/public/file.te b/public/file.te index 53b5c7a6f..34347cbb7 100644 --- a/public/file.te +++ b/public/file.te @@ -280,6 +280,11 @@ type vendor_public_framework_file, vendor_file_type, file_type; # Files having this type should be read-only. type vendor_microdroid_file, vendor_file_type, file_type; +starting_at_board_api(202504, ` + # boot otas for 16KB developer option + type vendor_boot_ota_file, vendor_file_type, file_type; +') + # Input configuration type vendor_keylayout_file, vendor_file_type, file_type; type vendor_keychars_file, vendor_file_type, file_type;