commit ebe1316695f624614194152c516f5c45268befd8
author Rhed Jao <rhedjao@google.com> Thu May 25 06:59:05 2023 +0000
committer Thiébaud Weksteen <tweek@google.com> Mon Oct 23 13:38:38 2023 +1100
tree 0e8e2c920bf8db8f3a9997389bb78dfabfe5dbdc
parent 87fa0f9f773aa00d8e39a041c08accf7a5c3914c

Create sepolicy for allowing system_server rw in /metadata/repair-mode

Bug: 277561275
Test: ls -all -Z /metadata/repair-mode
Change-Id: Ie27b6ef377bb3503e87fbc5bb2446bc0de396123

private/compat/33.0/33.0.ignore.cil

diff --git a/private/compat/33.0/33.0.ignore.cil b/private/compat/33.0/33.0.ignore.cil
index 618bb11..3f18f8c 100644
--- a/private/compat/33.0/33.0.ignore.cil
+++ b/private/compat/33.0/33.0.ignore.cil
@@ -63,6 +63,7 @@
     quick_start_prop
     recovery_usb_config_prop
     remote_provisioning_service
+    repair_mode_metadata_file
     rkpdapp
     servicemanager_prop
     shutdown_checkpoints_system_data_file

private/file_contexts

diff --git a/private/file_contexts b/private/file_contexts
index 3a9c04d..600c2b8 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -841,6 +841,7 @@
 /metadata/staged-install(/.*)?    u:object_r:staged_install_file:s0
 /metadata/userspacereboot(/.*)?    u:object_r:userspace_reboot_metadata_file:s0
 /metadata/watchdog(/.*)?    u:object_r:watchdog_metadata_file:s0
+/metadata/repair-mode(/.*)?    u:object_r:repair_mode_metadata_file:s0
 
 #############################
 # asec containers

private/system_server.te

diff --git a/private/system_server.te b/private/system_server.te
index 0856bd6..099d786 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1435,6 +1435,9 @@
 allow system_server watchdog_metadata_file:dir rw_dir_perms;
 allow system_server watchdog_metadata_file:file create_file_perms;
 
+allow system_server repair_mode_metadata_file:dir rw_dir_perms;
+allow system_server repair_mode_metadata_file:file create_file_perms;
+
 allow system_server gsi_persistent_data_file:dir rw_dir_perms;
 allow system_server gsi_persistent_data_file:file create_file_perms;