0a5f561c67
Uncrypt needs search in /dev/block to open block devices.
Allow it.
Addresses the following denial:
[11105.601711] type=1400 audit(1393550350.528:30): avc: denied { search } for pid=14597 comm="uncrypt" name="block" dev="tmpfs" ino=7200 scontext=u:r:uncrypt:s0 tcontext=u:object_r:block_device:s0 tclass=dir
Change-Id: I4592784135a04ff5bff2715e1250661744f12aa1
30 lines
899 B
Text
30 lines
899 B
Text
# uncrypt
|
|
type uncrypt, domain;
|
|
type uncrypt_exec, exec_type, file_type;
|
|
|
|
init_daemon_domain(uncrypt)
|
|
|
|
allow uncrypt self:capability dac_override;
|
|
|
|
# Read OTA zip file from /data/data/com.google.android.gsf/app_download
|
|
r_dir_file(uncrypt, app_data_file)
|
|
|
|
userdebug_or_eng(`
|
|
# For debugging, allow /data/local/tmp access
|
|
r_dir_file(uncrypt, shell_data_file)
|
|
')
|
|
|
|
# Create tmp file /cache/recovery/command.tmp
|
|
# Read /cache/recovery/command
|
|
# Rename /cache/recovery/command.tmp to /cache/recovery/command
|
|
allow uncrypt cache_file:dir rw_dir_perms;
|
|
allow uncrypt cache_file:file create_file_perms;
|
|
|
|
# Set a property to reboot the device.
|
|
unix_socket_connect(uncrypt, property, init)
|
|
allow uncrypt powerctl_prop:property_service set;
|
|
|
|
# Raw writes to block device
|
|
allow uncrypt self:capability sys_rawio;
|
|
allow uncrypt block_device:blk_file w_file_perms;
|
|
allow uncrypt block_device:dir r_dir_perms;
|