Files
device_google_wahoo/sepolicy/update_engine_common.te
Max Bires ed261e9c7e Refactoring block device labeling and adding allows.
Denials:
denied { write ioctl open } for pid=847 comm="folio_daemon"
name="uinput" dev="tmpfs" ino=20677 scontext=u:r:folio_daemon:s0
tcontext=u:object_r:uhid_device:s0 tclass=chr_file

denied { search } for pid=1553 comm="rild" name="netmgr" dev="tmpfs"
ino=21012 scontext=u:r:rild:s0 tcontext=u:object_r:netmgrd_socket:s0
tclass=dir

denied { read write open } for pid=689 comm="qseecomd" name="sdd2"
dev="tmpfs" ino=18308 scontext=u:r:tee:s0
tcontext=u:object_r:ssd_block_device:s0 tclass=blk_file

denied { read write open } for pid=771 comm="rmt_storage" name="sdd15"
dev="tmpfs" ino=18347 scontext=u:r:rmt_storage:s0
tcontext=u:object_r:modem_block_device:s0 tclass=blk_file

denied { getattr } for comm="android.hardwar" path="/dev/block/sda7"
dev="tmpfs" ino=18138 scontext=u:r:hal_bootctl_default:s0
tcontext=u:object_r:modem_block_device:s0 tclass=blk_file

denied { getattr } for comm="android.hardwar" path="/dev/block/sda22"
dev="tmpfs" ino=18194 scontext=u:r:hal_bootctl_default:s0
tcontext=u:object_r:system_block_device:s0 tclass=blk_file

denied { getattr } for comm="android.hardwar" path="/dev/block/sda3"
dev="tmpfs" ino=18122 scontext=u:r:hal_bootctl_default:s0
tcontext=u:object_r:ab_block_device:s0 tclass=blk_file

denied { getattr } for comm="android.hardwar" path="/dev/block/sda9"
dev="tmpfs" ino=18146 scontext=u:r:hal_bootctl_default:s0
tcontext=u:object_r:boot_block_device:s0 tclass=blk_file

Bug: 34784662
Test: The above denials are no longer present
Change-Id: I0a31ed76665a660e658a1e9000e07a9d312fb985
2017-04-07 16:11:19 -07:00

4 lines
193 B
Plaintext

# Allow update_engine and update_engine_sideload (recovery) read/write on the
# device-specific partitions it should update.
allow update_engine_common xbl_block_device:blk_file rw_file_perms;