Skip to content
Snippets Groups Projects
Select Git revision
  • test default
1 result
Blame History Permalink
  • Branden Archer's avatar
    Allow init to set powerctl property · d36b1d5f
    Branden Archer authored 
    NIAP certification requires that all cryptographic functions
undergo a self-test during startup to demonstrate correct
operation. init now performs this check during startup.

The self-test is forked from init. For the child process
to be able to request a reboot it needs permissions to
set the sys.powerctl property.

Bug: 119826244
Test: Built for walleye. When the BoringSSL self test was forced
      to fail the device rebooted into the bootloader, as
      expected.

Change-Id: I4171b1dd0a5e393252ae5c002171ac51c9cbb3e6
    d36b1d5f
init.te 1012 B 
typeattribute init coredomain;

tmpfs_domain(init)

# Transitions to seclabel processes in init.rc
domain_trans(init, rootfs, charger)
domain_trans(init, rootfs, healthd)
domain_trans(init, rootfs, slideshow)
domain_auto_trans(init, e2fs_exec, e2fs)
recovery_only(`
  domain_trans(init, rootfs, adbd)
  domain_trans(init, rootfs, fastbootd)
  domain_trans(init, rootfs, recovery)
')
domain_trans(init, shell_exec, shell)
domain_trans(init, init_exec, ueventd)
domain_trans(init, init_exec, vendor_init)
domain_trans(init, { rootfs toolbox_exec }, modprobe)
userdebug_or_eng(`
  # case where logpersistd is actually logcat -f in logd context (nee: logcatd)
  domain_auto_trans(init, logcat_exec, logpersist)

  # allow init to execute services marked with seclabel u:r:su:s0 in userdebug/eng
  allow init su:process transition;
  dontaudit init su:process noatsecure;
  allow init su:process { siginh rlimitinh };
')

# Allow the BoringSSL self test to request a reboot upon failure
set_prop(init, powerctl_prop)