1# update_verifier 2type update_verifier, domain; 3type update_verifier_exec, exec_type, file_type; 4 5# Allow update_verifier to reach block devices in /dev/block. 6allow update_verifier block_device:dir search; 7 8# Read care map in /data/ota_package/. 9allow update_verifier ota_package_file:dir r_dir_perms; 10allow update_verifier ota_package_file:file r_file_perms; 11 12# Read /sys/block to find all the DM directories like (/sys/block/dm-X). 13allow update_verifier sysfs:dir r_dir_perms; 14 15# Read /sys/block/dm-X/dm/name (which is a symlink to 16# /sys/devices/virtual/block/dm-X/dm/name) to identify the mapping between 17# dm-X and system/vendor partitions. 18allow update_verifier sysfs_dm:dir r_dir_perms; 19allow update_verifier sysfs_dm:file r_file_perms; 20 21# Read all blocks in DM wrapped system partition. 22allow update_verifier dm_device:blk_file r_file_perms; 23 24# Write to kernel message. 25allow update_verifier kmsg_device:chr_file w_file_perms; 26 27# Allow update_verifier to reboot the device. 28set_prop(update_verifier, powerctl_prop) 29 30# Use Boot Control HAL 31hal_client_domain(update_verifier, hal_bootctl) 32