diff options
| author | Nick Kralevich <nnk@google.com> | 2014-07-07 13:19:24 -0700 |
|---|---|---|
| committer | Nick Kralevich <nnk@google.com> | 2014-07-07 13:23:30 -0700 |
| commit | 558710cdcc619682ef600d281f09ab4dad221692 (patch) | |
| tree | 65fa27d8826d0de08a90815734b863e00275748a /recovery.te | |
| parent | c0088b8064318210e775555ff4634994f7ab9e34 (diff) | |
| download | android_external_sepolicy-558710cdcc619682ef600d281f09ab4dad221692.tar.gz android_external_sepolicy-558710cdcc619682ef600d281f09ab4dad221692.tar.bz2 android_external_sepolicy-558710cdcc619682ef600d281f09ab4dad221692.zip | |
recovery: allow relabelto unlabeled and other unlabeled rules
The recovery script may ask to label a file with a label not
known to the currently loaded policy. Allow it.
Addresses the following denials:
avc: denied { relabelto } for pid=143 comm="update_binary" name="vdc" dev="mmcblk0p25" ino=212 scontext=u:r:recovery:s0 tcontext=u:object_r:unlabeled:s0 tclass=file
avc: denied { setattr } for pid=143 comm="update_binary" name="vdc" dev="mmcblk0p25" ino=212 scontext=u:r:recovery:s0 tcontext=u:object_r:unlabeled:s0 tclass=file
Change-Id: Iafcc7b0b3aaea5a272adb1264233978365648f94
Diffstat (limited to 'recovery.te')
| -rw-r--r-- | recovery.te | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/recovery.te b/recovery.te index cd2447c..282ed3e 100644 --- a/recovery.te +++ b/recovery.te @@ -30,6 +30,11 @@ recovery_only(` allow recovery system_file:{ file lnk_file } { create_file_perms relabelfrom relabelto }; allow recovery system_file:dir { create_dir_perms relabelfrom relabelto }; + # We may be asked to set an SELinux label for a type not known to the + # currently loaded policy. Allow it. + allow recovery unlabeled:file { create_file_perms relabelfrom relabelto }; + allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto }; + # 0eb17d944704b3eb140bb9dded299d3be3aed77e in build/ added SELinux # support to OTAs. However, that code has a bug. When an update occurs, # some directories are inappropriately labeled as exec_type. This is |