sepolicy changes to support ota metadata in super partition
Bug: 330744468
Test: Pixel 6 incremental flashing with wipe
Change-Id: I16edbbd200b7501b5812038db47409dc04f50957
Signed-off-by: Akilesh Kailash <akailash@google.com>
diff --git a/private/file_contexts b/private/file_contexts
index d49be64..394d3b7 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -883,6 +883,12 @@
/metadata/aconfig/flags(/.*)? u:object_r:aconfig_storage_flags_metadata_file:s0
/metadata/aconfig_test_missions(/.*)? u:object_r:aconfig_test_mission_files:s0
+############################
+# mount point for ota metadata
+/mnt/scratch_ota_metadata_super(/.*)? u:object_r:ota_metadata_file:s0
+/mnt/scratch_ota_metadata_super/ota(/.*)? u:object_r:ota_metadata_file:s0
+/mnt/scratch_ota_metadata_super/ota/snapshots(/.*)? u:object_r:ota_metadata_file:s0
+
#############################
# asec containers
/mnt/asec(/.*)? u:object_r:asec_apk_file:s0
diff --git a/private/update_engine_common.te b/private/update_engine_common.te
index 5bba84a..6de0292 100644
--- a/private/update_engine_common.te
+++ b/private/update_engine_common.te
@@ -107,5 +107,5 @@
# Allow to read/write/create OTA metadata files for snapshot status and COW file status.
allow update_engine_common metadata_file:dir search;
-allow update_engine_common ota_metadata_file:dir rw_dir_perms;
+allow update_engine_common ota_metadata_file:dir { rw_dir_perms rmdir };
allow update_engine_common ota_metadata_file:file create_file_perms;