Skip to content
Snippets Groups Projects
  • Tianjie Xu's avatar
    Add sepolicy for update_verifier · 59379d8b
    Tianjie Xu authored
    (cherry picked from commit 5d8d2dc9)
    
    Grant update_verifier the permissions to read /data/ota_package/
    and the blocks on system partition.
    
    The denial messages:
    update_verifier: type=1400 audit(0.0:29): avc: denied { read }
    scontext=u:r:update_verifier:s0 tcontext=u:object_r:ota_package_file:s0 tclass=file permissive=1
    
    update_verifier: type=1400 audit(0.0:30): avc: denied { open }
    scontext=u:r:update_verifier:s0 tcontext=u:object_r:ota_package_file:s0 tclass=file permissive=1
    
    update_verifier: type=1400 audit(0.0:31): avc: denied { read } dev="tmpfs"
    scontext=u:r:update_verifier:s0 tcontext=u:object_r:system_block_device:s0 tclass=blk_file permissive=1
    
    update_verifier: type=1400 audit(0.0:32): avc: denied { open } dev="tmpfs"
    scontext=u:r:update_verifier:s0 tcontext=u:object_r:system_block_device:s0 tclass=blk_file permissive=1
    
    Test: On device, update_verifier reads the blocks successfully during boot time.
    Bug: 30020920
    
    Change-Id: I10777c1e6ba649b82c4a73171124742edeb05997
    59379d8b