SEAndroid: Updated vold domain related policystable/cm-12.0-YNG4Nstable/cm-12.0-YNG3Cstable/cm-12.0-YNG1TAstable/cm-12.0-YNG1Tstable/cm-12.0-YNG1Icm-12.0

Updated vold domain related policy where it need access
to dirty_ratio on proc  and update kernel rules  where it need
access to the blk file on  vold device node

Change-Id: I0aca64860530d291e4c3a374e82a7d623498aa28

4 files changed, 10 insertions, 0 deletions

diff --git a/file.te b/file.te
index dcd0a37..f5bcd06 100644
--- a/file.te
+++ b/file.te
@@ -156,6 +156,9 @@ type zygote_socket, file_type;
 # UART (for GPS) control proc file
 type gps_control, file_type;
 
+# Used by vold
+type  proc_dirty_ratio, fs_type;
+
 # Allow files to be created in their appropriate filesystems.
 allow fs_type self:filesystem associate;
 allow sysfs_type sysfs:filesystem associate;
diff --git a/genfs_contexts b/genfs_contexts
index 31b7e4f..b9c6f3f 100644
--- a/genfs_contexts
+++ b/genfs_contexts
@@ -20,6 +20,7 @@ genfscon proc /sys/kernel/randomize_va_space u:object_r:proc_security:s0
 genfscon proc /sys/kernel/usermodehelper u:object_r:usermodehelper:s0
 genfscon proc /sys/net u:object_r:proc_net:s0
 genfscon proc /sys/vm/mmap_min_addr u:object_r:proc_security:s0
+genfscon proc /sys/vm/dirty_ratio  u:object_r:proc_dirty_ratio:s0
 # selinuxfs booleans can be individually labeled.
 genfscon selinuxfs / u:object_r:selinuxfs:s0
 genfscon cgroup / u:object_r:cgroup:s0
diff --git a/kernel.te b/kernel.te
index 3a80265..a4170ad 100644
--- a/kernel.te
+++ b/kernel.te
@@ -65,3 +65,6 @@ neverallow domain kernel:process { transition dyntransition };
 # - You are running an exploit which switched to the init task credentials
 #   and is then trying to exec a shell or other program.  You lose!
 neverallow kernel { file_type fs_type -rootfs }:file { entrypoint execute_no_trans };
+
+# For UMS full-device exports
+allow kernel block_device:blk_file r_file_perms;
diff --git a/vold.te b/vold.te
index 591630a..ca163e4 100644
--- a/vold.te
+++ b/vold.te
@@ -91,3 +91,6 @@ binder_call(vold, healthd)
 # talk to keymaster
 allow vold tee_device:chr_file rw_file_perms;
 
+# For UMS tuning
+allow vold proc_dirty_ratio:file rw_file_perms;
+