PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

am 206b1a6c: Define specific block device types for system and recovery partitions.

Browse Source 
* commit '206b1a6c45f1bae25906018d9c5d968330106826':
  Define specific block device types for system and recovery partitions.
This commit is contained in:
Stephen Smalley 2014-10-02 16:08:33 +00:00 committed by Android Git Automerger
commit e923f65a80
3 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
device.te
View File

@ -68,6 +68,12 @@ type root_block_device, dev_type;
# factory reset protection block device
type frp_block_device, dev_type;
# System block device mounted on /system.
type system_block_device, dev_type;
# Recovery block device.
type recovery_block_device, dev_type;
# Userdata block device mounted on /data.
type userdata_block_device, dev_type;

6
domain.te
View File

@ -318,3 +318,9 @@ neverallow domain default_android_service:service_manager add;
neverallow { domain -init } default_prop:property_service set;
neverallow { domain -init -recovery -system_server } frp_block_device:blk_file rw_file_perms;
# No domain other than recovery can write to system.
neverallow { domain -recovery } system_block_device:blk_file write;
# No domains other than install_recovery or recovery can write to recovery.
neverallow { domain -install_recovery -recovery } recovery_block_device:blk_file write;

2
install_recovery.te
View File

@ -18,6 +18,8 @@ allow install_recovery system_file:file rx_file_perms;
# create an appropriate label for it.
allow install_recovery block_device:dir search;
allow install_recovery block_device:blk_file rw_file_perms;
auditallow install_recovery block_device:blk_file rw_file_perms;
allow install_recovery recovery_block_device:blk_file rw_file_perms;
# Create and delete /cache/saved.file
allow install_recovery cache_file:dir rw_dir_perms;