4aecb3f2eb
grant rw_dir_perms of dir /data/server_configurable_flags to flags_health_check.te, in order to enable flags_health_check to record reset flags data as file under this dir for later use. See function: server_configurable_flags::ServerConfigurableFlagsReset for how the permission is used. Test: manual on device Change-Id: I1df7b8cadfbe279f26bf828e9e725ce170a376f7
29 lines
1.8 KiB
Text
29 lines
1.8 KiB
Text
# The flags_health_check command run by init.
|
|
type flags_health_check, domain, coredomain;
|
|
type flags_health_check_exec, system_file_type, exec_type, file_type;
|
|
|
|
set_prop(flags_health_check, device_config_boot_count_prop)
|
|
set_prop(flags_health_check, device_config_reset_performed_prop)
|
|
|
|
# STOPSHIP: Remove the ability for flags_health_check to set property
|
|
# device_config_flags_health_check_prop before release. (b/119627143)
|
|
set_prop(flags_health_check, device_config_flags_health_check_prop)
|
|
|
|
allow flags_health_check server_configurable_flags_data_file:dir rw_dir_perms;
|
|
allow flags_health_check server_configurable_flags_data_file:file create_file_perms;
|
|
|
|
# system property device_config_boot_count_prop is used for deciding when to perform server
|
|
# configurable flags related disaster recovery. Mistakenly set up by unrelated components can, at a
|
|
# wrong timing, trigger server configurable flag related disaster recovery, which will override
|
|
# server configured values of all flags with default values.
|
|
neverallow { domain -init -flags_health_check } device_config_boot_count_prop:property_service set;
|
|
|
|
# system property device_config_reset_performed_prop is used for indicating whether server
|
|
# configurable flags have been reset during booting. Mistakenly modified by unrelated components can
|
|
# cause bad server configurable flags synced back to device.
|
|
neverallow { domain -init -flags_health_check } device_config_reset_performed_prop:property_service set;
|
|
|
|
# server_configurable_flags_data_file is used for storing whether server configurable flags which
|
|
# have been reset during current booting. Mistakenly modified by unrelated components can
|
|
# cause bad server configurable flags synced back to device.
|
|
neverallow { domain -init -flags_health_check } server_configurable_flags_data_file:file no_w_file_perms;
|