1# update_engine payload application permissions. These are shared between the 2# background daemon and the recovery tool to sideload an update. 3 4# Allow update_engine to reach block devices in /dev/block. 5allow update_engine_common block_device:dir search; 6 7# Allow read/write on system and boot partitions. 8allow update_engine_common boot_block_device:blk_file rw_file_perms; 9allow update_engine_common system_block_device:blk_file rw_file_perms; 10 11# Where ioctls are granted via standard allow rules to block devices, 12# automatically allow common ioctls that are generally needed by 13# update_engine. 14allowxperm update_engine_common dev_type:blk_file ioctl { 15 BLKDISCARD 16 BLKDISCARDZEROES 17 BLKROGET 18 BLKROSET 19 BLKSECDISCARD 20 BLKZEROOUT 21}; 22 23# Allow to set recovery options in the BCB. Used to trigger factory reset when 24# the update to an older version (channel change) or incompatible version 25# requires it. 26allow update_engine_common misc_block_device:blk_file rw_file_perms; 27 28# read fstab 29allow update_engine_common rootfs:dir getattr; 30allow update_engine_common rootfs:file r_file_perms; 31 32# Allow update_engine_common to mount on the /postinstall directory and reset the 33# labels on the mounted filesystem to postinstall_file. 34allow update_engine_common postinstall_mnt_dir:dir { mounton getattr search }; 35allow update_engine_common postinstall_file:filesystem { mount unmount relabelfrom relabelto }; 36allow update_engine_common labeledfs:filesystem { mount unmount relabelfrom }; 37 38# Allow update_engine_common to read and execute postinstall_file. 39allow update_engine_common postinstall_file:file rx_file_perms; 40allow update_engine_common postinstall_file:lnk_file r_file_perms; 41allow update_engine_common postinstall_file:dir r_dir_perms; 42 43# install update.zip from cache 44r_dir_file(update_engine_common, cache_file) 45 46# A postinstall program is typically a shell script (with a #!), so we allow 47# to execute those. 48allow update_engine_common shell_exec:file rx_file_perms; 49 50# Allow update_engine_common to suspend, resume and kill the postinstall program. 51allow update_engine_common postinstall:process { signal sigstop sigkill }; 52 53# access /proc/cmdline 54allow update_engine_common proc_cmdline:file r_file_perms; 55 56# Read files in /sys/firmware/devicetree/base/firmware/android/ 57r_dir_file(update_engine_common, sysfs_dt_firmware_android) 58 59# Needed because libdm reads sysfs to validate when a dm path is ready. 60r_dir_file(update_engine_common, sysfs_dm) 61 62# Scan files in /sys/fs/ext4 and /sys/fs/f2fs for device-mapper diagnostics. 63allow update_engine_common sysfs:dir r_dir_perms; 64allow update_engine_common sysfs_fs_f2fs:dir r_dir_perms; 65 66# read / write on /dev/device-mapper to map / unmap devices 67allow update_engine_common dm_device:chr_file rw_file_perms; 68 69# apply / verify updates on devices mapped via device mapper 70allow update_engine_common dm_device:blk_file rw_file_perms; 71 72# read /dev/dm-user, so that we can inotify wait for control devices to be 73# asynchronously created by ueventd. 74allow update_engine dm_user_device:dir r_dir_perms; 75 76# read / write metadata on super device to resize partitions 77allow update_engine_common super_block_device_type:blk_file rw_file_perms; 78 79# ioctl on super device to get block device alignment and alignment offset 80allowxperm update_engine_common super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF }; 81 82# get physical block device to map logical partitions on device mapper 83allow update_engine_common block_device:dir r_dir_perms; 84 85# Allow update_engine_common to write to statsd socket. 86unix_socket_send(update_engine_common, statsdw, statsd) 87 88# Allow to read Virtual A/B feature flags. 89get_prop(update_engine_common, virtual_ab_prop) 90 91# Allow to read GKI related flags. 92get_prop(update_engine_common, ab_update_gki_prop) 93get_prop(update_engine_common, build_bootimage_prop) 94 95# Allow to read/write/create OTA metadata files for snapshot status and COW file status. 96allow update_engine_common metadata_file:dir search; 97allow update_engine_common ota_metadata_file:dir rw_dir_perms; 98allow update_engine_common ota_metadata_file:file create_file_perms; 99