Add sepolicy for /metadata/tradeinmode.
This defines a new type, tradeinmode_metadata_file, which is applied to
/metadata/tradeinmode. This directory contains an indicator, written by
system_server, that a factory reset must be initiated. The indicator is
read by first-stage init.
A neverallow rule is included since we don't want random processes reading or writing to this directory.
Bug: 307713521
Test: adb shell tradeinmode enter
Change-Id: Icc3c815a77bbadc1d4b32b88226e55a5595f5388
diff --git a/private/system_server.te b/private/system_server.te
index 6a13816..f39668e 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1504,6 +1504,10 @@
allow system_server password_slot_metadata_file:dir rw_dir_perms;
allow system_server password_slot_metadata_file:file create_file_perms;
+# Allow TradeInMode service rw access to /metadata/tradeinmode.
+allow system_server tradeinmode_metadata_file:dir rw_dir_perms;
+allow system_server tradeinmode_metadata_file:file create_file_perms;
+
allow system_server userspace_reboot_metadata_file:dir create_dir_perms;
allow system_server userspace_reboot_metadata_file:file create_file_perms;
@@ -1679,6 +1683,9 @@
neverallow { domain -init -system_server } crashrecovery_prop:property_service set;
neverallow { domain -init -dumpstate -system_server } crashrecovery_prop:file no_rw_file_perms;
+# Do not allow anything other than system_server and init to touch /metadata/tradeinmode.
+neverallow { domain -init -system_server } tradeinmode_metadata_file:file no_rw_file_perms;
+
neverallow {
domain
-init