Files
device_google_wahoo/sepolicy/update_engine_common.te
Max Bires 0a4f88cbd3 Fixing Taimen OTAs for enforcing before turning it on globally
denied { ioctl } for pid=570 comm="boot@1.0-servic"
path="/dev/block/sde" dev="tmpfs" ino=19779 ioctlcmd=1268
scontext=u:r:hal_bootctl_default:s0 tcontext=u:object_r:block_device:s0
tclass=blk_file

denied { open } for pid=570 comm="boot@1.0-servic" path="/dev/block/sde"
dev="tmpfs" ino=19779 scontext=u:r:hal_bootctl_default:s0
tcontext=u:object_r:block_device:s0 tclass=blk_file

denied { read write } for pid=570 comm="boot@1.0-servic" name="sde"
dev="tmpfs" ino=19779 scontext=u:r:hal_bootctl_default:s0
tcontext=u:object_r:block_device:s0 tclass=blk_file

denied { getattr } for pid=570 comm="boot@1.0-servic"
path="/dev/block/sde13" dev="tmpfs" ino=19819
scontext=u:r:hal_bootctl_default:s0 tcontext=u:object_r:block_device:s0
tclass=blk_file

Bug: 34784662
Test: OTAs work
Change-Id: Idd78395353c54f5d81220f7c8073ab90ee22af2f
2017-05-09 13:17:44 -07:00

9 lines
451 B
Plaintext

# Allow update_engine and update_engine_sideload (recovery) read/write on the
# device-specific partitions it should update.
allow update_engine_common xbl_block_device:blk_file rw_file_perms;
allow update_engine_common ab_block_device:blk_file rw_file_perms;
allow update_engine_common modem_block_device:blk_file rw_file_perms;
allow update_engine_common postinstall_mnt_dir:dir r_dir_perms;
allow update_engine_common tmpfs:lnk_file r_file_perms;