platform_vendor_tequila/sepolicy/system_app.te

# For the updaters
allow system_app cache_recovery_file:dir create_dir_perms;
allow system_app cache_recovery_file:file create_file_perms;
allow system_app media_rw_data_file:dir create_dir_perms;
allow system_app media_rw_data_file:file create_file_perms;

# Boot animation
allow system_app ctl_bootanim_prop:property_service set;
sepolicy: Split off /cache/recovery's permissions /cache/recovery is used by 2 domains: recovery and updater apps. Separate its perms from the rest of /cache and grant them to those 2 clients Change-Id: Iacde60744c07423f9876c2f8e3da900543e38ddf 2015-02-05 23:33:47 +01:00			`# For the updaters`
sepolicy: More cleanups for N * Fix up recovery stuff * Disable themes until ready * Disable CMUpdater until ready Change-Id: I99073b91fbd1ec16e59602da644727a0d019f330 2016-08-26 12:28:00 +02:00			`allow system_app cache_recovery_file:dir create_dir_perms;`
			`allow system_app cache_recovery_file:file create_file_perms;`
sepolicy: Allow system apps to write cache and media files Updaters need to be able to read and write to these locations. Change-Id: I928a5f73ec29ab4fecb717072532d449192f3ca9 2015-02-18 02:36:37 +01:00			`allow system_app media_rw_data_file:dir create_dir_perms;`
			`allow system_app media_rw_data_file:file create_file_perms;`
sepolicy: Allow system app to set boot anim property Addresses denials observerd when using QuickBoot: <4>[ 224.756971] avc: denied { set } for property=ctl.bootanim scontext=u:r:system_app:s0 tcontext=u:object_r:ctl_bootanim_prop:s0 tclass=property_service <3>[ 224.757094] init: sys_prop: Unable to start service ctl [bootanim] uid:1000 gid:1000 pid:6039 <4>[ 226.306456] avc: denied { set } for property=ctl.bootanim scontext=u:r:system_app:s0 tcontext=u:object_r:ctl_bootanim_prop:s0 tclass=property_service Change-Id: I338a0a1d5fa12c10e413769ea9638c10ed137000 2015-09-21 16:38:54 +02:00
			`# Boot animation`
			`allow system_app ctl_bootanim_prop:property_service set;`