commit 1a15808dc0babf1d7988ed0f09681e9bac57cbb6
author Jaegeuk Kim <jaegeuk@google.com> Tue May 25 05:13:57 2021 -0700
committer Todd Kennedy <toddke@google.com> Thu May 27 20:31:17 2021 -0700
tree 4f8449c2360f951b3dbf2c8daefc1f2e279399e8
parent 73854e626de0bc623e9386c571b8896bd9ab496a

sepolicy: allow to play f2fs-compression for apk files

This patch adds some ioctls for apk files and allows
shell to query for f2fs features.

Bug: 189169940
Test: Manual. Code runs.
Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
Change-Id: Ia8bccf1bf663404b902703326a1853947b64e5ab

private/system_server.te

diff --git a/private/system_server.te b/private/system_server.te
index 9dd4b1b..7239a30 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -44,11 +44,28 @@
   INCFS_IOCTL_FILL_BLOCKS
   INCFS_IOCTL_GET_FILLED_BLOCKS
   INCFS_IOCTL_GET_BLOCK_COUNT
+  F2FS_IOC_GET_FEATURES
+  F2FS_IOC_GET_COMPRESS_BLOCKS
+  F2FS_IOC_COMPRESS_FILE
+  F2FS_IOC_DECOMPRESS_FILE
+  F2FS_IOC_RELEASE_COMPRESS_BLOCKS
+  F2FS_IOC_RESERVE_COMPRESS_BLOCKS
+  FS_IOC_SETFLAGS
+  FS_IOC_GETFLAGS
+};
+
+allowxperm system_server apk_tmp_file:file ioctl {
+  F2FS_IOC_RELEASE_COMPRESS_BLOCKS
+  FS_IOC_GETFLAGS
 };
 
 # For Incremental Service to check incfs metrics
 allow system_server sysfs_fs_incfs_metrics:file r_file_perms;
 
+# For f2fs-compression support
+allow system_server sysfs_fs_f2fs:dir r_dir_perms;
+allow system_server sysfs_fs_f2fs:file r_file_perms;
+
 # For art.
 allow system_server { apex_art_data_file dalvikcache_data_file }:dir r_dir_perms;
 allow system_server { apex_art_data_file dalvikcache_data_file }:file r_file_perms;