Keystore 2.0: Add early_boot_ended permission
Add early_boot_ended permission to the keystore2 access vector. This
permission must be checked before allowing calls to earlyBootEnded() on
Keymint devices.
Bug: 181821046
Bug: 181910578
Change-Id: I8860a4424a249455ab540b6c2896e7d836ceb8a3
diff --git a/private/access_vectors b/private/access_vectors
index fdac890..78dc135 100644
--- a/private/access_vectors
+++ b/private/access_vectors
@@ -721,6 +721,7 @@
change_user
clear_ns
clear_uid
+ early_boot_ended
get_auth_token
get_state
list
diff --git a/private/vold.te b/private/vold.te
index ba5ad8c..93a3515 100644
--- a/private/vold.te
+++ b/private/vold.te
@@ -45,6 +45,12 @@
use
};
+# vold needs to find keystore2 services
+allow vold keystore_maintenance_service:service_manager find;
+
+# vold needs to be able to call earlyBootEnded()
+allow vold keystore:keystore2 early_boot_ended;
+
neverallow {
domain
-system_server