2014-02-19 13:33:32 -08:00
|
|
|
# uncrypt
|
2017-05-15 13:19:03 -07:00
|
|
|
type uncrypt, domain, mlstrustedsubject;
|
2018-09-27 10:21:37 -07:00
|
|
|
type uncrypt_exec, system_file_type, exec_type, file_type;
|
2014-02-19 13:33:32 -08:00
|
|
|
|
2018-09-06 15:19:40 -07:00
|
|
|
allow uncrypt self:global_capability_class_set { dac_override dac_read_search };
|
2014-02-19 13:33:32 -08:00
|
|
|
|
2014-02-20 11:47:00 -08:00
|
|
|
userdebug_or_eng(`
|
|
|
|
# For debugging, allow /data/local/tmp access
|
|
|
|
r_dir_file(uncrypt, shell_data_file)
|
|
|
|
')
|
|
|
|
|
2014-02-19 13:33:32 -08:00
|
|
|
# Read /cache/recovery/command
|
2015-05-20 16:29:42 -07:00
|
|
|
# Read /cache/recovery/uncrypt_file
|
2017-07-09 16:43:55 -07:00
|
|
|
allow uncrypt cache_file:dir search;
|
2015-12-22 12:37:17 -08:00
|
|
|
allow uncrypt cache_recovery_file:dir rw_dir_perms;
|
|
|
|
allow uncrypt cache_recovery_file:file create_file_perms;
|
2016-02-26 10:30:12 -08:00
|
|
|
|
2016-05-24 21:07:48 -07:00
|
|
|
# Read OTA zip file at /data/ota_package/.
|
|
|
|
allow uncrypt ota_package_file:dir r_dir_perms;
|
|
|
|
allow uncrypt ota_package_file:file r_file_perms;
|
|
|
|
|
2016-02-26 10:30:12 -08:00
|
|
|
# Write to /dev/socket/uncrypt
|
|
|
|
unix_socket_connect(uncrypt, uncrypt, uncrypt)
|
2014-02-19 13:33:32 -08:00
|
|
|
|
|
|
|
# Set a property to reboot the device.
|
2015-05-04 18:22:45 -07:00
|
|
|
set_prop(uncrypt, powerctl_prop)
|
2014-02-19 13:33:32 -08:00
|
|
|
|
|
|
|
# Raw writes to block device
|
2017-11-09 14:51:26 -08:00
|
|
|
allow uncrypt self:global_capability_class_set sys_rawio;
|
2015-10-05 14:04:39 -07:00
|
|
|
allow uncrypt misc_block_device:blk_file w_file_perms;
|
2014-02-27 17:24:43 -08:00
|
|
|
allow uncrypt block_device:dir r_dir_perms;
|
2014-09-11 05:50:04 -07:00
|
|
|
|
|
|
|
# Access userdata block device.
|
2015-01-05 15:03:43 -08:00
|
|
|
allow uncrypt userdata_block_device:blk_file w_file_perms;
|
2016-09-09 16:27:17 -07:00
|
|
|
|
|
|
|
r_dir_file(uncrypt, rootfs)
|
2017-07-25 16:43:49 -07:00
|
|
|
|
|
|
|
# uncrypt reads /proc/cmdline
|
2017-10-02 15:31:46 -07:00
|
|
|
allow uncrypt proc_cmdline:file r_file_perms;
|
2017-07-27 06:43:30 -07:00
|
|
|
|
|
|
|
# Read files in /sys
|
/proc, /sys access from uncrypt, update_engine, postinstall_dexopt
New types:
1. proc_random
2. sysfs_dt_firmware_android
Labeled:
1. /proc/sys/kernel/random as proc_random.
2. /sys/firmware/devicetree/base/firmware/android/{compatible, fstab,
vbmeta} as sysfs_dt_firmware_android.
Changed access:
1. uncrypt, update_engine, postinstall_dexopt have access to generic proc
and sysfs labels removed.
2. appropriate permissions were added to uncrypt, update_engine,
update_engine_common, postinstall_dexopt.
Bug: 67416435
Bug: 67416336
Test: fake ota go/manual-ab-ota runs without denials
Test: adb sideload runs without denials to new types
Change-Id: Id31310ceb151a18652fcbb58037a0b90c1f6505a
2017-10-04 10:34:11 -07:00
|
|
|
r_dir_file(uncrypt, sysfs_dt_firmware_android)
|