Add sepolicy for /metadata/tradeinmode.
This defines a new type, tradeinmode_metadata_file, which is applied to
/metadata/tradeinmode. This directory contains an indicator, written by
system_server, that a factory reset must be initiated. The indicator is
read by first-stage init.
A neverallow rule is included since we don't want random processes reading or writing to this directory.
Bug: 307713521
Test: adb shell tradeinmode enter
Change-Id: Icc3c815a77bbadc1d4b32b88226e55a5595f5388
diff --git a/private/vendor_init.te b/private/vendor_init.te
index 84ec60e..0a2d62c 100644
--- a/private/vendor_init.te
+++ b/private/vendor_init.te
@@ -115,6 +115,7 @@
-userspace_reboot_metadata_file
-aconfig_storage_metadata_file
-aconfig_storage_flags_metadata_file
+ -tradeinmode_metadata_file
enforce_debugfs_restriction(`-debugfs_type')
}:file { create getattr open read write setattr relabelfrom unlink map };