platform_system_sepolicy/private/fastbootd.te
David Anderson 8303577f09 Allow snapuserd interaction in recovery and fastbootd.
This is needed to support VABC merges on data wipes and via "fastboot
snapshot-update merge".

Bug: 168258606
Test: fastboot snapshot-update merge
      data wipe during VABC merge
Change-Id: I32770a2e74f2c2710e4964f65c42ae779c1a0b90
2021-02-04 22:48:55 -08:00

41 lines
1.3 KiB
Text

typeattribute fastbootd coredomain;
# The allow rules are only included in the recovery policy.
# Otherwise fastbootd is only allowed the domain rules.
recovery_only(`
# Reboot the device
set_prop(fastbootd, powerctl_prop)
# Read serial number of the device from system properties
get_prop(fastbootd, serialno_prop)
# Set sys.usb.ffs.ready.
get_prop(fastbootd, ffs_config_prop)
set_prop(fastbootd, ffs_control_prop)
userdebug_or_eng(`
get_prop(fastbootd, persistent_properties_ready_prop)
')
set_prop(fastbootd, gsid_prop)
# Determine allocation scheme (whether B partitions needs to be
# at the second half of super.
get_prop(fastbootd, virtual_ab_prop)
# Needed for TCP protocol
allow fastbootd node:tcp_socket node_bind;
allow fastbootd port:tcp_socket name_bind;
allow fastbootd self:tcp_socket { create_socket_perms_no_ioctl listen accept };
# Start snapuserd for merging VABC updates
set_prop(fastbootd, ctl_snapuserd_prop)
# Needed to communicate with snapuserd to complete merges.
allow fastbootd snapuserd_socket:sock_file write;
allow fastbootd snapuserd:unix_stream_socket connectto;
allow fastbootd dm_user_device:dir r_dir_perms;
# Get fastbootd protocol property
get_prop(fastbootd, fastbootd_protocol_prop)
')