5854941f63
Grant ReadDefaultFstab() callers
allow scontext { metadata_file gsi_metadata_file_type }:dir search;
allow scontext gsi_public_metadata_file:file r_file_perms;
so they can search / read DSU metadata files.
The DSU metadata files are required to deduce the correct fstab.
Also tighten the neverallow rules in gsid.te.
Bug: 181110285
Test: Build pass, presubmit test
Test: Boot and check avc denials
Test: Boot with DSU and check avc denials
Change-Id: Ie464b9a8f7a89f9cf8f4e217dad1322ba3ad0633
16 lines
645 B
Text
16 lines
645 B
Text
# Boot control subsystem
|
|
type hal_bootctl_default, domain;
|
|
hal_server_domain(hal_bootctl_default, hal_bootctl)
|
|
|
|
type hal_bootctl_default_exec, exec_type, vendor_file_type, file_type;
|
|
init_daemon_domain(hal_bootctl_default)
|
|
|
|
# Needed for ReadDefaultFstab.
|
|
allow hal_bootctl_default proc_cmdline:file r_file_perms;
|
|
allow hal_bootctl_default sysfs_dt_firmware_android:dir search;
|
|
allow hal_bootctl_default sysfs_dt_firmware_android:file r_file_perms;
|
|
read_fstab(hal_bootctl_default)
|
|
|
|
# Needed for reading/writing misc partition.
|
|
allow hal_bootctl_default block_device:dir search;
|
|
allow hal_bootctl_default misc_block_device:blk_file rw_file_perms;
|