From 12443b7a516a66f691ee4c0fa1e72a45b290a10c Mon Sep 17 00:00:00 2001 From: Connor O'Brien <connoro@google.com> Date: Fri, 18 Nov 2016 18:44:07 -0800 Subject: [PATCH] Add permissions for hal_boot The service running the boot control HAL needs the permissions provided by the boot_control_hal attribute. update_engine and update_verifier still also need these permissions in order to successfully call the new HAL in pass-through mode, but also need permission to call the new service. Bug: 31864052 Test: Built and confirmed no permission denials. Change-Id: I2a6fdd5cf79b9e461d7cc14bd5b7abd6481ed911 Signed-off-by: Connor O'Brien <connoro@google.com> --- public/hal_boot.te | 2 +- public/update_engine.te | 4 ++++ public/update_verifier.te | 2 -- 3 files changed, 5 insertions(+), 3 deletions(-) diff --git a/public/hal_boot.te b/public/hal_boot.te index 327fbf98f..3cbbb2916 100644 --- a/public/hal_boot.te +++ b/public/hal_boot.te @@ -1,5 +1,5 @@ # boot_control subsystem -type hal_boot, domain; +type hal_boot, domain, boot_control_hal; type hal_boot_exec, exec_type, file_type; # hwbinder access diff --git a/public/update_engine.te b/public/update_engine.te index a3dee0db7..2c6e585b6 100644 --- a/public/update_engine.te +++ b/public/update_engine.te @@ -33,3 +33,7 @@ binder_call(update_engine, priv_app) # Read OTA zip file at /data/ota_package/. allow update_engine ota_package_file:file r_file_perms; allow update_engine ota_package_file:dir r_dir_perms; + +# Use binderized HAL +hwbinder_use(update_engine) +binder_call(update_engine, hal_boot) diff --git a/public/update_verifier.te b/public/update_verifier.te index 550cf659f..abbc7663d 100644 --- a/public/update_verifier.te +++ b/public/update_verifier.te @@ -16,5 +16,3 @@ allow update_verifier system_block_device:blk_file r_file_perms; # Use binderized HAL hwbinder_use(update_verifier) binder_call(update_verifier, hal_boot) - -allow update_verifier system_file:dir r_dir_perms; -- GitLab