Merge "Update bug_map to explicitly have the b/ prefix"
diff --git a/private/domain.te b/private/domain.te
index 8d63fbe..98251d0 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -261,7 +261,6 @@
dumpstate
init
installd
- install_recovery
userdebug_or_eng(`llkd')
lmkd
migrate_legacy_obb_data
diff --git a/private/incident.te b/private/incident.te
index 98101e0..db9ae86 100644
--- a/private/incident.te
+++ b/private/incident.te
@@ -4,10 +4,17 @@
# switch to incident domain for incident command
domain_auto_trans(shell, incident_exec, incident)
+domain_auto_trans(dumpstate, incident_exec, incident)
# allow incident access to stdout from its parent shell.
allow incident shell:fd use;
+# allow incident to communicate with dumpstate, and write incident report to
+# /data/data/com.android.shell/files/bugreports/tmp_incident_report
+allow incident dumpstate:fd use;
+allow incident dumpstate:unix_stream_socket { read write };
+allow incident shell_data_file:file write;
+
# allow incident be able to output data for CTS to fetch.
allow incident devpts:chr_file { read write };
@@ -26,5 +33,5 @@
binder_call(incident, incidentd)
allow incident incidentd:fifo_file write;
-# only allow incident being called by shell
-neverallow { domain -su -shell -incident } incident_exec:file { execute execute_no_trans };
+# only allow incident being called by shell or dumpstate
+neverallow { domain -su -shell -incident -dumpstate} incident_exec:file { execute execute_no_trans };
diff --git a/public/install_recovery.te b/public/install_recovery.te
index 0aee9ab..00caf25 100644
--- a/public/install_recovery.te
+++ b/public/install_recovery.te
@@ -2,8 +2,6 @@
type install_recovery, domain;
type install_recovery_exec, system_file_type, exec_type, file_type;
-allow install_recovery self:global_capability_class_set { dac_override dac_read_search };
-
# /system/bin/install-recovery.sh is a shell script.
# Needs to execute /system/bin/sh
allow install_recovery shell_exec:file rx_file_perms;
@@ -19,9 +17,5 @@
allow install_recovery boot_block_device:blk_file r_file_perms;
allow install_recovery recovery_block_device:blk_file rw_file_perms;
-# Create and delete /cache/saved.file
-allow install_recovery cache_file:dir rw_dir_perms;
-allow install_recovery cache_file:file create_file_perms;
-
# Write to /proc/sys/vm/drop_caches
allow install_recovery proc_drop_caches:file w_file_perms;