4db8cbd552
Bug: 171861574
Test: execute following command on a device with a SD card inserted
adb shell am start-activity \
-n com.android.dynsystem/com.android.dynsystem.VerificationActivity \
-a android.os.image.action.START_INSTALL \
-d file:///storage/emulated/0/Download/system.raw.gz \
--el KEY_SYSTEM_SIZE $(du -b system.raw|cut -f1) \
--el KEY_USERDATA_SIZE 4294967296
Change-Id: I5c1c170ade9c570c7dab7cb7aff5f099db4b3d8c
33 lines
1.4 KiB
Text
33 lines
1.4 KiB
Text
typeattribute kernel coredomain;
|
|
|
|
domain_auto_trans(kernel, init_exec, init)
|
|
domain_auto_trans(kernel, snapuserd_exec, snapuserd)
|
|
|
|
# Allow the kernel to read otapreopt_chroot's file descriptors and files under
|
|
# /postinstall, as it uses apexd logic to mount APEX packages in /postinstall/apex.
|
|
allow kernel otapreopt_chroot:fd use;
|
|
allow kernel postinstall_file:file read;
|
|
|
|
# The following sections are for the transition period during a Virtual A/B
|
|
# OTA. Once sepolicy is loaded, snapuserd must be re-launched in the correct
|
|
# context, and with properly labelled devices. This must be done before
|
|
# enabling enforcement, eg, in permissive mode while still in the kernel
|
|
# context.
|
|
allow kernel tmpfs:blk_file { getattr relabelfrom };
|
|
allow kernel tmpfs:chr_file { getattr relabelfrom };
|
|
allow kernel tmpfs:lnk_file { getattr relabelfrom };
|
|
allow kernel tmpfs:dir { open read relabelfrom };
|
|
|
|
allow kernel block_device:blk_file relabelto;
|
|
allow kernel block_device:lnk_file relabelto;
|
|
allow kernel dm_device:chr_file relabelto;
|
|
allow kernel dm_device:blk_file relabelto;
|
|
allow kernel dm_user_device:dir { read open search relabelto };
|
|
allow kernel dm_user_device:chr_file relabelto;
|
|
allow kernel kmsg_device:chr_file relabelto;
|
|
allow kernel null_device:chr_file relabelto;
|
|
allow kernel random_device:chr_file relabelto;
|
|
allow kernel snapuserd_exec:file relabelto;
|
|
|
|
allow kernel kmsg_device:chr_file write;
|
|
allow kernel gsid:fd use;
|