1 # update_engine payload application permissions. These are shared between the 2 # background daemon and the recovery tool to sideload an update. 3 4 # Allow update_engine to reach block devices in /dev/block. 5 allow update_engine_common block_device:dir search; 6 7 # Allow read/write on system and boot partitions. 8 allow update_engine_common boot_block_device:blk_file rw_file_perms; 9 allow update_engine_common system_block_device:blk_file rw_file_perms; 10 11 # Allow to set recovery options in the BCB. Used to trigger factory reset when 12 # the update to an older version (channel change) or incompatible version 13 # requires it. 14 allow update_engine_common misc_block_device:blk_file rw_file_perms; 15 16 # read fstab 17 allow update_engine_common rootfs:dir getattr; 18 allow update_engine_common rootfs:file r_file_perms; 19 20 # Allow update_engine_common to mount on the /postinstall directory and reset the 21 # labels on the mounted filesystem to postinstall_file. 22 allow update_engine_common postinstall_mnt_dir:dir { mounton getattr search }; 23 allow update_engine_common postinstall_file:filesystem { mount unmount relabelfrom relabelto }; 24 allow update_engine_common labeledfs:filesystem relabelfrom; 25 26 # Allow update_engine_common to read and execute postinstall_file. 27 allow update_engine_common postinstall_file:file rx_file_perms; 28 allow update_engine_common postinstall_file:lnk_file r_file_perms; 29 allow update_engine_common postinstall_file:dir r_dir_perms; 30 31 # install update.zip from cache 32 r_dir_file(update_engine_common, cache_file) 33 34 # A postinstall program is typically a shell script (with a #!), so we allow 35 # to execute those. 36 allow update_engine_common shell_exec:file rx_file_perms; 37 38 # Allow update_engine_common to suspend, resume and kill the postinstall program. 39 allow update_engine_common postinstall:process { signal sigstop sigkill }; 40 41 # access /proc/misc 42 # Access is also granted to proc:file, but it is likely unneeded 43 # due to the more specific grant to proc_misc immediately below. 44 allow update_engine proc:file r_file_perms; # delete candidate 45 allow update_engine proc_misc:file r_file_perms; 46 47 # read directories on /system and /vendor 48 allow update_engine system_file:dir r_dir_perms; 49
