diff options
| author | Luca Stefani <luca.stefani.ge1@gmail.com> | 2019-01-03 22:50:44 +0100 |
|---|---|---|
| committer | razorloves <razorloves@gmail.com> | 2019-01-08 07:33:15 +0100 |
| commit | 9c28a0dfb91bb468515e123b1aaf3fcfc007b82f (patch) | |
| tree | eca08b0b53800d72bc95f179b9f7885ba900dafe | |
| parent | fcb902d6cdb542b8a81ddb7399436ab3b7300069 (diff) | |
| download | android_device_lineage_sepolicy-lineage-15.1.tar.gz android_device_lineage_sepolicy-lineage-15.1.tar.bz2 android_device_lineage_sepolicy-lineage-15.1.zip | |
Make A/B backuptool permissivelineage-15.1
Change-Id: Ib1f52f40dab26ac4575e06bfd54b88809b00f8d3
(cherry picked from commit 618adbf2185c7d67e469132a6ae54931b3ab84a8)
| -rw-r--r-- | common/private/backuptool.te | 5 | ||||
| -rw-r--r-- | common/private/update_engine.te | 13 |
2 files changed, 10 insertions, 8 deletions
diff --git a/common/private/backuptool.te b/common/private/backuptool.te new file mode 100644 index 0000000..f5a9b2d --- /dev/null +++ b/common/private/backuptool.te @@ -0,0 +1,5 @@ +type backuptool, domain, coredomain; + +permissive backuptool; + +neverallow { domain -update_engine } backuptool:process transition; diff --git a/common/private/update_engine.te b/common/private/update_engine.te index 309699a..c257b03 100644 --- a/common/private/update_engine.te +++ b/common/private/update_engine.te @@ -1,13 +1,10 @@ -allow update_engine self:capability { dac_override dac_read_search sys_rawio }; - +# Read updates from storage data r_dir_file(update_engine, mnt_user_file) r_dir_file(update_engine, storage_file) -allow update_engine self:capability { chown fsetid sys_rawio }; - +# Allow mount and unmount of system partition allow update_engine labeledfs:filesystem { mount unmount }; -allow update_engine { media_rw_data_file rootfs sdcardfs system_data_file system_file }:dir create_dir_perms; -allow update_engine { media_rw_data_file rootfs sdcardfs system_data_file system_file }:{ file lnk_file } create_file_perms; -allow update_engine { otapreopt_chroot_exec rootfs system_file toolbox_exec }:file rx_file_perms; -allow update_engine { rootfs system_file }:file { relabelfrom relabelto }; +# Allow transition to backuptool domain +allow update_engine self:process setexec; +domain_trans(update_engine, otapreopt_chroot_exec, backuptool) |