diff options
| author | Gabriele M <moto.falcon.git@gmail.com> | 2017-01-25 02:09:04 +0100 |
|---|---|---|
| committer | Łukasz Patron <priv.luk@gmail.com> | 2020-04-13 16:31:01 +0200 |
| commit | cd91d71669cd43ff30d4b3bfd26f0d0f54135d2c (patch) | |
| tree | 05667a7806817878fb5c5b89e745f61cc03d132d | |
| parent | a93e0c3a3035755cd755836aa022b587c48046f8 (diff) | |
| download | android_system_sepolicy-cd91d71669cd43ff30d4b3bfd26f0d0f54135d2c.tar.gz android_system_sepolicy-cd91d71669cd43ff30d4b3bfd26f0d0f54135d2c.tar.bz2 android_system_sepolicy-cd91d71669cd43ff30d4b3bfd26f0d0f54135d2c.zip | |
sepolicy: Allow recovery to alter /
This is needed for /etc/fstab, /adb_keys and volmgr
Change-Id: I53332a57ce7879d7ba63c4ea3e27add01f5a3a90
| -rw-r--r-- | prebuilts/api/29.0/public/domain.te | 4 | ||||
| -rw-r--r-- | public/domain.te | 4 |
2 files changed, 4 insertions, 4 deletions
diff --git a/prebuilts/api/29.0/public/domain.te b/prebuilts/api/29.0/public/domain.te index fe68ed02..6f3a19cd 100644 --- a/prebuilts/api/29.0/public/domain.te +++ b/prebuilts/api/29.0/public/domain.te @@ -488,8 +488,8 @@ neverallow { domain -kernel with_asan(`-asan_extract') } { system_file_type vend neverallow * exec_type:dir_file_class_set mounton; neverallow { domain -init } { system_file_type vendor_file_type }:dir_file_class_set mounton; -# Nothing should be writing to files in the rootfs. -neverallow * rootfs:file { create write setattr relabelto append unlink link rename }; +# Nothing should be writing to files in the rootfs, except recovery. +neverallow { domain -recovery } rootfs:file { create write setattr relabelto append unlink link rename }; # Restrict context mounts to specific types marked with # the contextmount_type attribute. diff --git a/public/domain.te b/public/domain.te index fe68ed02..6f3a19cd 100644 --- a/public/domain.te +++ b/public/domain.te @@ -488,8 +488,8 @@ neverallow { domain -kernel with_asan(`-asan_extract') } { system_file_type vend neverallow * exec_type:dir_file_class_set mounton; neverallow { domain -init } { system_file_type vendor_file_type }:dir_file_class_set mounton; -# Nothing should be writing to files in the rootfs. -neverallow * rootfs:file { create write setattr relabelto append unlink link rename }; +# Nothing should be writing to files in the rootfs, except recovery. +neverallow { domain -recovery } rootfs:file { create write setattr relabelto append unlink link rename }; # Restrict context mounts to specific types marked with # the contextmount_type attribute. |