From 4de505b6fb60265aa4e451a207260fe4bd9e8160 Mon Sep 17 00:00:00 2001 From: Jin Qian Date: Tue, 2 May 2017 13:45:08 -0700 Subject: [PATCH] allow init to run mke2fs tools to format partitions Test: let fs_mgr format a damaged /data partition Bug: 35219933 Change-Id: If92352ea7a70780e9d81ab10963d63e16b793792 (cherry picked from commit 5f573ab2aa8f566c723f4ddd576f8365dcaec191) --- private/e2fs.te | 14 ++++++++++++++ private/file_contexts | 2 ++ private/genfs_contexts | 1 + private/init.te | 1 + public/e2fs.te | 1 + public/file.te | 1 + 6 files changed, 20 insertions(+) create mode 100644 private/e2fs.te create mode 100644 public/e2fs.te diff --git a/private/e2fs.te b/private/e2fs.te new file mode 100644 index 000000000..add1cc2a4 --- /dev/null +++ b/private/e2fs.te @@ -0,0 +1,14 @@ +type e2fs, domain, coredomain; + +allow e2fs block_device:blk_file getattr; +allow e2fs block_device:dir search; +allow e2fs userdata_block_device:blk_file rw_file_perms; + +# access /proc/filesystems +allow e2fs proc:file r_file_perms; + +# access /sys/fs/ext4/features +allow e2fs sysfs_fs_ext4_features:file r_file_perms; + +# access sselinux context files +allow e2fs file_contexts_file:file { getattr open read }; diff --git a/private/file_contexts b/private/file_contexts index d35d47dda..8faa6cd63 100644 --- a/private/file_contexts +++ b/private/file_contexts @@ -17,6 +17,8 @@ /charger u:object_r:rootfs:s0 /init u:object_r:init_exec:s0 /sbin(/.*)? u:object_r:rootfs:s0 +/sbin/e2fsdroid u:object_r:e2fs_exec:s0 +/sbin/mke2fs u:object_r:e2fs_exec:s0 # For kernel modules /lib(/.*)? u:object_r:rootfs:s0 diff --git a/private/genfs_contexts b/private/genfs_contexts index 54e9a2c40..3914cec7d 100644 --- a/private/genfs_contexts +++ b/private/genfs_contexts @@ -56,6 +56,7 @@ genfscon sysfs /devices/virtual/block/zram1 u:object_r:sysfs_zram:s0 genfscon sysfs /devices/virtual/block/zram0/uevent u:object_r:sysfs_zram_uevent:s0 genfscon sysfs /devices/virtual/block/zram1/uevent u:object_r:sysfs_zram_uevent:s0 genfscon sysfs /devices/virtual/misc/hw_random u:object_r:sysfs_hwrandom:s0 +genfscon sysfs /fs/ext4/features u:object_r:sysfs_fs_ext4_features:s0 genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0 genfscon sysfs /power/wake_unlock u:object_r:sysfs_wake_lock:s0 genfscon sysfs /kernel/uevent_helper u:object_r:usermodehelper:s0 diff --git a/private/init.te b/private/init.te index 726f1381c..5c23f66f1 100644 --- a/private/init.te +++ b/private/init.te @@ -6,6 +6,7 @@ tmpfs_domain(init) domain_trans(init, rootfs, charger) domain_trans(init, rootfs, healthd) domain_trans(init, rootfs, slideshow) +domain_auto_trans(init, e2fs_exec, e2fs) recovery_only(` domain_trans(init, rootfs, adbd) domain_trans(init, rootfs, recovery) diff --git a/public/e2fs.te b/public/e2fs.te new file mode 100644 index 000000000..ecb25a2cf --- /dev/null +++ b/public/e2fs.te @@ -0,0 +1 @@ +type e2fs_exec, exec_type, file_type; diff --git a/public/file.te b/public/file.te index 18e43347a..a525090cf 100644 --- a/public/file.te +++ b/public/file.te @@ -42,6 +42,7 @@ type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject; type sysfs_wake_lock, fs_type, sysfs_type; type sysfs_mac_address, fs_type, sysfs_type; type sysfs_usb, sysfs_type, file_type, mlstrustedobject; +type sysfs_fs_ext4_features, sysfs_type, fs_type; type configfs, fs_type; # /sys/devices/system/cpu type sysfs_devices_system_cpu, fs_type, sysfs_type;