e06ed7d09a
(cherry picked from commit 6c3f2831ac)
Allow priv_app, uncrypt, update_engine to access the OTA packages at
/data/ota_package (both A/B and non-A/B). GMSCore (priv_app) checks
the existence of the folder, and downloads the package there if present.
Bug: 28944800
Change-Id: I3c0717861fce7f93b33874a99f6a4a55567612a5
40 lines
1.1 KiB
Text
40 lines
1.1 KiB
Text
# uncrypt
|
|
type uncrypt, domain, domain_deprecated, mlstrustedsubject;
|
|
type uncrypt_exec, exec_type, file_type;
|
|
|
|
init_daemon_domain(uncrypt)
|
|
|
|
allow uncrypt self:capability dac_override;
|
|
|
|
# Read OTA zip file from /data/data/com.google.android.gsf/app_download
|
|
r_dir_file(uncrypt, app_data_file)
|
|
|
|
userdebug_or_eng(`
|
|
# For debugging, allow /data/local/tmp access
|
|
r_dir_file(uncrypt, shell_data_file)
|
|
')
|
|
|
|
# Read /cache/recovery/command
|
|
# Read /cache/recovery/uncrypt_file
|
|
allow uncrypt cache_recovery_file:dir rw_dir_perms;
|
|
allow uncrypt cache_recovery_file:file create_file_perms;
|
|
|
|
# Read OTA zip file at /data/ota_package/.
|
|
allow uncrypt ota_package_file:dir r_dir_perms;
|
|
allow uncrypt ota_package_file:file r_file_perms;
|
|
|
|
# Write to /dev/socket/uncrypt
|
|
unix_socket_connect(uncrypt, uncrypt, uncrypt)
|
|
|
|
# Set a property to reboot the device.
|
|
set_prop(uncrypt, powerctl_prop)
|
|
|
|
# Raw writes to block device
|
|
allow uncrypt self:capability sys_rawio;
|
|
allow uncrypt misc_block_device:blk_file w_file_perms;
|
|
allow uncrypt block_device:dir r_dir_perms;
|
|
|
|
# Access userdata block device.
|
|
allow uncrypt userdata_block_device:blk_file w_file_perms;
|
|
|
|
r_dir_file(uncrypt, rootfs)
|