From 558710cdcc619682ef600d281f09ab4dad221692 Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Mon, 7 Jul 2014 13:19:24 -0700
Subject: [PATCH] recovery: allow relabelto unlabeled and other unlabeled rules
The recovery script may ask to label a file with a label not
known to the currently loaded policy. Allow it.
Addresses the following denials:
avc: denied { relabelto } for pid=143 comm="update_binary" name="vdc" dev="mmcblk0p25" ino=212 scontext=u:r:recovery:s0 tcontext=u:object_r:unlabeled:s0 tclass=file
avc: denied { setattr } for pid=143 comm="update_binary" name="vdc" dev="mmcblk0p25" ino=212 scontext=u:r:recovery:s0 tcontext=u:object_r:unlabeled:s0 tclass=file
Change-Id: Iafcc7b0b3aaea5a272adb1264233978365648f94
---
recovery.te | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/recovery.te b/recovery.te
index cd2447c2f..282ed3e4d 100644
--- a/recovery.te
+++ b/recovery.te
@@ -30,6 +30,11 @@ recovery_only(`
allow recovery system_file:{ file lnk_file } { create_file_perms relabelfrom relabelto };
allow recovery system_file:dir { create_dir_perms relabelfrom relabelto };
+ # We may be asked to set an SELinux label for a type not known to the
+ # currently loaded policy. Allow it.
+ allow recovery unlabeled:file { create_file_perms relabelfrom relabelto };
+ allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto };
+
# 0eb17d944704b3eb140bb9dded299d3be3aed77e in build/ added SELinux
# support to OTAs. However, that code has a bug. When an update occurs,
# some directories are inappropriately labeled as exec_type. This is
--
GitLab