PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Move boot_control_hal attribute to hal_boot domain

Browse Source 
Grant boot_control_hal permissions to the hal_boot service;
update_engine and update_verifier can call that service rather
than using those permissions themselves.

Bug: 31864052
Test: `bootctl set-active-boot-slot 1`
Change-Id: I5188bc32e7933d4a0f5135b3246df119d3523d69
This commit is contained in:
Alex Deymo 2016-11-08 16:04:17 -08:00 committed by Connor O'Brien
parent 747c69f43c
commit 1f3294659d
3 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
public/hal_boot.te
View File

@ -1,5 +1,5 @@
# boot_control subsystem # boot_control subsystem
type hal_boot, domain; type hal_boot, domain, boot_control_hal;
type hal_boot_exec, exec_type, file_type; type hal_boot_exec, exec_type, file_type;
# hwbinder access # hwbinder access

7
public/update_engine.te
View File

@ -1,6 +1,5 @@
# Domain for update_engine daemon. # Domain for update_engine daemon.
# update_engine uses the boot_control_hal. type update_engine, domain, domain_deprecated, update_engine_common;
type update_engine, domain, domain_deprecated, update_engine_common, boot_control_hal;
type update_engine_exec, exec_type, file_type; type update_engine_exec, exec_type, file_type;
type update_engine_data_file, file_type, data_file_type; type update_engine_data_file, file_type, data_file_type;
@ -33,3 +32,7 @@ binder_call(update_engine, priv_app)
# Read OTA zip file at /data/ota_package/. # Read OTA zip file at /data/ota_package/.
allow update_engine ota_package_file:file r_file_perms; allow update_engine ota_package_file:file r_file_perms;
allow update_engine ota_package_file:dir r_dir_perms; allow update_engine ota_package_file:dir r_dir_perms;
# Use binderized boot HAL.
hwbinder_use(update_engine)
binder_call(update_engine, hal_boot)

6
public/update_verifier.te
View File

@ -1,6 +1,5 @@
# update_verifier # update_verifier
# update_verifier uses the boot_control_hal. type update_verifier, domain;
type update_verifier, domain, boot_control_hal;
type update_verifier_exec, exec_type, file_type; type update_verifier_exec, exec_type, file_type;
# Allow update_verifier to reach block devices in /dev/block. # Allow update_verifier to reach block devices in /dev/block.
@ -13,8 +12,7 @@ allow update_verifier ota_package_file:file r_file_perms;
# Read all blocks in system partition. # Read all blocks in system partition.
allow update_verifier system_block_device:blk_file r_file_perms; allow update_verifier system_block_device:blk_file r_file_perms;
# Use binderized HAL # Use binderized boot HAL.
hwbinder_use(update_verifier) hwbinder_use(update_verifier)
binder_call(update_verifier, hal_boot) binder_call(update_verifier, hal_boot)
allow update_verifier system_file:dir r_dir_perms;