Home | History | Annotate | Download | only in sepolicy
      1 # These are the permissions required to use the boot_control HAL implemented
      2 # here: hardware/qcom/bootctrl/boot_control.c
      3 
      4 # Getting and setting GPT attributes for the bootloader iterates over all the
      5 # partition names in the block_device directory /dev/block/.../by-name
      6 allow boot_control_hal block_device:dir { open read };
      7 
      8 # Allow boot_control_hal to get attributes on all the A/B partitions.
      9 allow boot_control_hal {
     10   custom_ab_block_device
     11   xbl_block_device
     12   boot_block_device
     13   ssd_block_device
     14   modem_block_device
     15   system_block_device
     16 }:blk_file { getattr };
     17 
     18 # Allow the boot_control_hal to edit the attributes stored in the GPT.
     19 allow boot_control_hal gpt_block_device:blk_file rw_file_perms;
     20 
     21 # Allow boot_control_hal to access /dev/sgN devices (generic SCSI) to write the
     22 # A/B slot selection for the XBL partition. Allow also to issue a
     23 # UFS_IOCTL_QUERY ioctl.
     24 allow boot_control_hal sg_device:chr_file rw_file_perms;
     25 
     26 # Allow boot_control_hal to write to the XBL devices.
     27 allow boot_control_hal xbl_block_device:blk_file rw_file_perms;
     28