David Anderson 6557d87b0f Add sepolicy for installing GSIs to external storage. ... To install GSIs on external storage (such as sdcards), gsid needs some additional privileges: - proc_cmdline and device-tree access to call ReadDefaultFstab(). This is ultimately used to check whether system's dm-verity has check_at_most_once enabled, which is disallowed with sdcards. - vfat read/write access to write files to the sdcard. Note that adopted sdcards are not supported here. - read access to the sdcard block device. To enable this without providing access to vold_block_device, a new sdcard_block_device label was added. Devices must apply this label appropriately to enable gsid access. - FIBMAP access for VFAT filesystems, as they do not support FIEMAP. This only appears to work by granting SYS_RAWIO. Bug: 126230649 Test: adb shell su root gsi_tool install --install_dir=/mnt/media_rw/... works without setenforce 0 Change-Id: I88d8d83e5f61d4c0490f912f226fe1fe38cd60ab		2019-03-27 17:12:51 -07:00
..
28.0.cil	add label for /proc/sys/fs/verity/require_signatures	2019-03-14 12:44:31 -07:00
28.0.ignore.cil	Add sepolicy for installing GSIs to external storage.	2019-03-27 17:12:51 -07:00