Add policy for command line tool to control MTE boot state.
Bug: 206895651
Change-Id: I2e84193668dcdf24bde1c7e12b3cfd8a03954a16
diff --git a/private/compat/32.0/32.0.ignore.cil b/private/compat/32.0/32.0.ignore.cil
index 43f8136..ae5ceee 100644
--- a/private/compat/32.0/32.0.ignore.cil
+++ b/private/compat/32.0/32.0.ignore.cil
@@ -41,6 +41,7 @@
hal_wifi_hostapd_service
hal_wifi_supplicant_service
locale_service
+ mtectrl
nearby_service
proc_watermark_boost_factor
proc_watermark_scale_factor
diff --git a/private/file_contexts b/private/file_contexts
index 4a04532..f70c972 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -309,6 +309,7 @@
/system/bin/lpdumpd u:object_r:lpdumpd_exec:s0
/system/bin/rss_hwm_reset u:object_r:rss_hwm_reset_exec:s0
/system/bin/perfetto u:object_r:perfetto_exec:s0
+/system/bin/mtectrl u:object_r:mtectrl_exec:s0
/system/bin/traced u:object_r:traced_exec:s0
/system/bin/traced_perf u:object_r:traced_perf_exec:s0
/system/bin/traced_probes u:object_r:traced_probes_exec:s0
diff --git a/private/mtectrl.te b/private/mtectrl.te
new file mode 100644
index 0000000..a89edda
--- /dev/null
+++ b/private/mtectrl.te
@@ -0,0 +1,9 @@
+# mtectrl is a tool to request MTE (Memory Tagging Extensions) from the bootloader.
+type mtectrl_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(mtectrl)
+
+# mtectrl communicates the request to the bootloader via the misc partition.
+allow mtectrl misc_block_device:blk_file w_file_perms;
+allow mtectrl block_device:dir r_dir_perms;
+read_fstab(mtectrl)