a52b561859
When using the A/B updater, a device specific hook is sometimes needed
to run after the new partitions are updated but before rebooting into
the new image. This hook is referred to throughout the code as the
"postinstall" step.
This patch creates a new execution domain "postinstall" which
update_engine will use to run said hook. Since the hook needs to run
from the new image (namelly, slot "B"), update_engine needs to
temporarly mount this B partition into /postinstall and then run a
program from there.
Since the new program in B runs from the old execution context in A, we
can't rely on the labels set in the xattr in the new filesystem to
enforce the policies baked into the old running image. Instead, when
temporarily mounting the new filesystem in update_engine, we override
all the new file attributes with the new postinstall_file type by
passing "context=u:object_r:postinstall_file:s0" to the mount syscall.
This allows us to set new rules specific to the postinstall environment
that are consistent with the rules in the old system.
Bug: 27177071
TEST=Deployed a payload with a trivial postinstall script to edison-eng.
(cherry picked from commit 6cb2c893b1)
Change-Id: I49a529eecf1ef0524819470876ef7c8c2659c7ef
21 lines
917 B
Plaintext
21 lines
917 B
Plaintext
# Domain where the postinstall program runs during the update.
|
|
# Extend the permissions in this domain to allow this program to access other
|
|
# files needed by the specific device on your device's sepolicy directory.
|
|
type postinstall, domain;
|
|
|
|
# Allow postinstall to write to its stdout/stderr when redirected via pipes to
|
|
# update_engine.
|
|
allow postinstall update_engine:fd use;
|
|
allow postinstall update_engine:fifo_file rw_file_perms;
|
|
|
|
# Allow postinstall to read and execute directories and files in the same
|
|
# mounted location.
|
|
allow postinstall postinstall_file:file rx_file_perms;
|
|
allow postinstall postinstall_file:lnk_file r_file_perms;
|
|
allow postinstall postinstall_file:dir r_dir_perms;
|
|
|
|
# Allow postinstall to execute the shell or other system executables.
|
|
allow postinstall shell_exec:file rx_file_perms;
|
|
allow postinstall system_file:file rx_file_perms;
|
|
allow postinstall toolbox_exec:file rx_file_perms;
|