diff options
| author | Steve Kondik <steve@cyngn.com> | 2014-12-01 10:38:25 -0800 |
|---|---|---|
| committer | Steve Kondik <shade@chemlab.org> | 2014-12-09 22:20:14 +0000 |
| commit | 06ec5853f36138ffdadca3e577f251b0381f3777 (patch) | |
| tree | f56cc7433b252d5375c6920d1989bb47ddaced19 | |
| parent | c4f6b977c5b320b7ccef98f5ba9fa716ceacfd82 (diff) | |
| download | vendor_replicant-06ec5853f36138ffdadca3e577f251b0381f3777.zip vendor_replicant-06ec5853f36138ffdadca3e577f251b0381f3777.tar.gz vendor_replicant-06ec5853f36138ffdadca3e577f251b0381f3777.tar.bz2 | |
sepolicy: More rules for recovery
Change-Id: Ie50c04eb83cb9c62f679a1c1aa2ac482af159f7e
| -rw-r--r-- | sepolicy/property.te | 1 | ||||
| -rw-r--r-- | sepolicy/property_contexts | 2 | ||||
| -rw-r--r-- | sepolicy/recovery.te | 15 |
3 files changed, 18 insertions, 0 deletions
diff --git a/sepolicy/property.te b/sepolicy/property.te index 6892010..fe7d9b2 100644 --- a/sepolicy/property.te +++ b/sepolicy/property.te @@ -1 +1,2 @@ type adbtcp_prop, property_type; +type recovery_prop, property_type; diff --git a/sepolicy/property_contexts b/sepolicy/property_contexts index e5566dc..b3a3540 100644 --- a/sepolicy/property_contexts +++ b/sepolicy/property_contexts @@ -1 +1,3 @@ service.adb.tcp.port u:object_r:adbtcp_prop:s0 +recovery.perf.mode u:object_r:recovery_prop:s0 +adb.secure u:object_r:recovery_prop:s0 diff --git a/sepolicy/recovery.te b/sepolicy/recovery.te index 06bef3f..9d17beb 100644 --- a/sepolicy/recovery.te +++ b/sepolicy/recovery.te @@ -1,8 +1,23 @@ +recovery_only(` + # Secure adb (setup_adbd) allow adbd adb_keys_file:dir search; +allow recovery adb_keys_file:dir r_dir_perms; allow recovery adb_keys_file:file r_file_perms; allow recovery shell_prop:property_service set; # Recovery dialogs unix_socket_connect(recovery, vold, vold) allow recovery tmpfs:sock_file create_file_perms; + +# Read packages.xml +allow recovery system_data_file:file r_file_perms; + +# Manage fstab and /adb_keys +allow recovery rootfs:file create_file_perms; +allow recovery rootfs:dir { write add_name }; + +# Control properties +allow recovery recovery_prop:property_service set; + +') |