Merge "SELinux policy for new managed system update APIs" am: 017c1ac1ed am: 3c723e58ea
am: a82733bead
Change-Id: I406d345e152cd59a1eb8a885575f737bd7e77c1f
diff --git a/private/system_server.te b/private/system_server.te
index d02ddb5..6e5e566 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -186,6 +186,7 @@
binder_call(system_server, netd)
binder_call(system_server, statsd)
binder_call(system_server, storaged)
+binder_call(system_server, update_engine)
binder_call(system_server, vold)
binder_call(system_server, wificond)
binder_call(system_server, wpantund)
@@ -341,6 +342,10 @@
allow system_server tun_device:chr_file rw_file_perms;
allowxperm system_server tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF };
+# Manage data/ota_package
+allow system_server ota_package_file:dir rw_dir_perms;
+allow system_server ota_package_file:file create_file_perms;
+
# Manage system data files.
allow system_server system_data_file:dir create_dir_perms;
allow system_server system_data_file:notdevfile_class_set create_file_perms;
@@ -676,6 +681,7 @@
allow system_server stats_service:service_manager find;
allow system_server storaged_service:service_manager find;
allow system_server surfaceflinger_service:service_manager find;
+allow system_server update_engine_service:service_manager find;
allow system_server vold_service:service_manager find;
allow system_server wificond_service:service_manager find;
userdebug_or_eng(`
diff --git a/public/update_engine.te b/public/update_engine.te
index d13be7d..6521726 100644
--- a/public/update_engine.te
+++ b/public/update_engine.te
@@ -39,6 +39,9 @@
# Allow update_engine to call the callback function provided by priv_app.
binder_call(update_engine, priv_app)
+# Allow update_engine to call the callback function provided by system_server.
+binder_call(update_engine, system_server)
+
# Read OTA zip file at /data/ota_package/.
allow update_engine ota_package_file:file r_file_perms;
allow update_engine ota_package_file:dir r_dir_perms;