Allow snapuserd interaction in recovery and fastbootd.
This is needed to support VABC merges on data wipes and via "fastboot
snapshot-update merge".
Bug: 168258606
Test: fastboot snapshot-update merge
data wipe during VABC merge
Change-Id: I32770a2e74f2c2710e4964f65c42ae779c1a0b90
diff --git a/private/fastbootd.te b/private/fastbootd.te
index f0ba02c..98eb23c 100644
--- a/private/fastbootd.te
+++ b/private/fastbootd.te
@@ -28,6 +28,14 @@
allow fastbootd port:tcp_socket name_bind;
allow fastbootd self:tcp_socket { create_socket_perms_no_ioctl listen accept };
+ # Start snapuserd for merging VABC updates
+ set_prop(fastbootd, ctl_snapuserd_prop)
+
+ # Needed to communicate with snapuserd to complete merges.
+ allow fastbootd snapuserd_socket:sock_file write;
+ allow fastbootd snapuserd:unix_stream_socket connectto;
+ allow fastbootd dm_user_device:dir r_dir_perms;
+
# Get fastbootd protocol property
get_prop(fastbootd, fastbootd_protocol_prop)
')
diff --git a/private/recovery.te b/private/recovery.te
index 207dfb6..00d7132 100644
--- a/private/recovery.te
+++ b/private/recovery.te
@@ -31,6 +31,14 @@
allow recovery self:tcp_socket { create ioctl };
allowxperm recovery self:tcp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS };
+ # Start snapuserd for merging VABC updates
+ set_prop(recovery, ctl_snapuserd_prop)
+
+ # Needed to communicate with snapuserd to complete merges.
+ allow recovery snapuserd_socket:sock_file write;
+ allow recovery snapuserd:unix_stream_socket connectto;
+ allow recovery dm_user_device:dir r_dir_perms;
+
# Set fastbootd protocol property
set_prop(recovery, fastbootd_protocol_prop)