Merge changes I81ab0a73,Ia66015b7
* changes:
Allow compsvc to execute odrefresh
Allow composd to run fd_server
diff --git a/microdroid/system/private/microdroid_manager.te b/microdroid/system/private/microdroid_manager.te
index 38fabcd..b914775 100644
--- a/microdroid/system/private/microdroid_manager.te
+++ b/microdroid/system/private/microdroid_manager.te
@@ -73,4 +73,8 @@
# Allow microdroid_manager to shutdown the device when verification fails
set_prop(microdroid_manager, powerctl_prop)
+# Allow microdroid_manager to read bootconfig so that it can reject a bootconfig
+# that is different from what is recorded in the instance.img file.
+allow microdroid_manager proc_bootconfig:file r_file_perms;
+
neverallow microdroid_manager { file_type fs_type }:file execute_no_trans;
diff --git a/public/recovery.te b/public/recovery.te
index 33658e8..b4b4109 100755
--- a/public/recovery.te
+++ b/public/recovery.te
@@ -9,9 +9,12 @@
recovery_only(`
# Allow recovery to perform an update as update_engine would do.
typeattribute recovery update_engine_common;
- # Recovery can only use HALs in passthrough mode
+ # Recovery can use HIDL HALs in passthrough mode
passthrough_hal_client_domain(recovery, hal_bootctl)
+ # Recovery can use AIDL HALs in binder mode
+ hal_client_domain(recovery, hal_health)
+
allow recovery self:global_capability_class_set {
chown
dac_override