commit 23173455ab48bbc1cc1e394717369e99e7175179
author Florian Mayer <fmayer@google.com> Wed Jan 19 15:19:20 2022 -0800
committer Florian Mayer <fmayer@google.com> Thu Jan 20 17:30:09 2022 +0000
tree 2aa50e6c05ba919ac72a057aecbba4c0884b4b51
parent 2413e27cc6d3282b81c0f6fcb40b989591775efd

Add policy for command line tool to control MTE boot state.

Bug: 206895651

Change-Id: I2e84193668dcdf24bde1c7e12b3cfd8a03954a16

private/mtectrl.te

diff --git a/private/mtectrl.te b/private/mtectrl.te
new file mode 100644
index 0000000..a89edda
--- /dev/null
+++ b/private/mtectrl.te
@@ -0,0 +1,9 @@
+# mtectrl is a tool to request MTE (Memory Tagging Extensions) from the bootloader.
+type mtectrl_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(mtectrl)
+
+# mtectrl communicates the request to the bootloader via the misc partition.
+allow mtectrl misc_block_device:blk_file w_file_perms;
+allow mtectrl block_device:dir r_dir_perms;
+read_fstab(mtectrl)