1# update_engine payload application permissions. These are shared between the
2# background daemon and the recovery tool to sideload an update.
3
4# Allow update_engine to reach block devices in /dev/block.
5allow update_engine_common block_device:dir search;
6
7# Allow read/write on system and boot partitions.
8allow update_engine_common boot_block_device:blk_file rw_file_perms;
9allow update_engine_common system_block_device:blk_file rw_file_perms;
10
11# Allow to set recovery options in the BCB. Used to trigger factory reset when
12# the update to an older version (channel change) or incompatible version
13# requires it.
14allow update_engine_common misc_block_device:blk_file rw_file_perms;
15
16# read fstab
17allow update_engine_common rootfs:dir getattr;
18allow update_engine_common rootfs:file r_file_perms;
19
20# Allow update_engine_common to mount on the /postinstall directory and reset the
21# labels on the mounted filesystem to postinstall_file.
22allow update_engine_common postinstall_mnt_dir:dir { mounton getattr search };
23allow update_engine_common postinstall_file:filesystem { mount unmount relabelfrom relabelto };
24allow update_engine_common labeledfs:filesystem relabelfrom;
25
26# Allow update_engine_common to read and execute postinstall_file.
27allow update_engine_common postinstall_file:file rx_file_perms;
28allow update_engine_common postinstall_file:lnk_file r_file_perms;
29allow update_engine_common postinstall_file:dir r_dir_perms;
30
31# install update.zip from cache
32r_dir_file(update_engine_common, cache_file)
33
34# A postinstall program is typically a shell script (with a #!), so we allow
35# to execute those.
36allow update_engine_common shell_exec:file rx_file_perms;
37
38# Allow update_engine_common to suspend, resume and kill the postinstall program.
39allow update_engine_common postinstall:process { signal sigstop sigkill };
40
41# access /proc/cmdline
42allow update_engine_common proc_cmdline:file r_file_perms;
43
44# Read files in /sys/firmware/devicetree/base/firmware/android/
45r_dir_file(update_engine_common, sysfs_dt_firmware_android)
46