From a8e073cde0e7d39ebe5d97de497edf22713d3501 Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Fri, 27 Feb 2015 17:39:09 -0800
Subject: [PATCH] Create boot_block_device and allow install_recovery read
 access

The install_recovery script creates a new recovery image based
off of the boot image plus a patch on /system. We need to allow
read access to the boot image to allow the patching to succeed,
otherwise OTAs are broken.

Addresses the following denial:

  type=1400 audit(9109404.519:6): avc: denied { read } for pid=341 comm="applypatch" name="mmcblk0p37" dev="tmpfs" ino=9186 scontext=u:r:install_recovery:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=0

TODO: Add device specific labels for the boot image.

Bug: 19534538
Change-Id: Ic811ec03e235df3b1bfca9b0a65e23307cd968aa
---
 device.te           | 3 +++
 install_recovery.te | 3 ++-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/device.te b/device.te
index 9ff30d5bc..c155fcced 100644
--- a/device.te
+++ b/device.te
@@ -76,6 +76,9 @@ type system_block_device, dev_type;
 # Recovery block device.
 type recovery_block_device, dev_type;
 
+# boot block device.
+type boot_block_device, dev_type;
+
 # Userdata block device mounted on /data.
 type userdata_block_device, dev_type;
 
diff --git a/install_recovery.te b/install_recovery.te
index 9155a2d41..138522036 100644
--- a/install_recovery.te
+++ b/install_recovery.te
@@ -13,8 +13,9 @@ allow install_recovery shell_exec:file rx_file_perms;
 # Execute /system/bin/applypatch
 allow install_recovery system_file:file rx_file_perms;
 
-# Update the recovery block device
+# Update the recovery block device based off a diff of the boot block device
 allow install_recovery block_device:dir search;
+allow install_recovery boot_block_device:blk_file r_file_perms;
 allow install_recovery recovery_block_device:blk_file rw_file_perms;
 
 # Create and delete /cache/saved.file
-- 
GitLab