Skip to content
Snippets Groups Projects
  • Tianjie Xu's avatar
    Add sepolicy for update_verifier · 5d8d2dc9
    Tianjie Xu authored
    Grant update_verifier the permissions to read /data/ota_package/
    and the blocks on system partition.
    
    The denial messages:
    update_verifier: type=1400 audit(0.0:29): avc: denied { read } for name="care_map.txt" dev="sda35"
    ino=1368066 scontext=u:r:update_verifier:s0 tcontext=u:object_r:ota_package_file:s0 tclass=file permissive=1
    
    update_verifier: type=1400 audit(0.0:30): avc: denied { open } for path="/data/ota_package/care_map.txt" dev="sda35"
    ino=1368066 scontext=u:r:update_verifier:s0 tcontext=u:object_r:ota_package_file:s0 tclass=file permissive=1
    
    update_verifier: type=1400 audit(0.0:31): avc: denied { read } for name="sda33" dev="tmpfs" ino=5613
    scontext=u:r:update_verifier:s0 tcontext=u:object_r:system_block_device:s0 tclass=blk_file permissive=1
    
    update_verifier: type=1400 audit(0.0:32): avc: denied { open } for path="/dev/block/sda33" dev="tmpfs" ino=5613
    scontext=u:r:update_verifier:s0 tcontext=u:object_r:system_block_device:s0 tclass=blk_file permissive=1
    
    Test: On sailfish, update_verifier reads the blocks successfully during boot time.
    Bug: 30020920
    
    Change-Id: I10777c1e6ba649b82c4a73171124742edeb05997
    5d8d2dc9