1*e4a36f41SAndroid Build Coastguard Worker# mtectrl is a tool to request MTE (Memory Tagging Extensions) from the bootloader. 2*e4a36f41SAndroid Build Coastguard Workertype mtectrl, domain, coredomain; 3*e4a36f41SAndroid Build Coastguard Workertype mtectrl_exec, system_file_type, exec_type, file_type; 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(mtectrl) 6*e4a36f41SAndroid Build Coastguard Worker 7*e4a36f41SAndroid Build Coastguard Worker# to set the sys prop to match the bootloader message state. 8*e4a36f41SAndroid Build Coastguard Workerset_prop(mtectrl, arm64_memtag_prop) 9*e4a36f41SAndroid Build Coastguard Worker 10*e4a36f41SAndroid Build Coastguard Worker# mtectrl communicates the request to the bootloader via the misc partition. 11*e4a36f41SAndroid Build Coastguard Worker# needs to write to update the request in misc partition, and read to sync 12*e4a36f41SAndroid Build Coastguard Worker# back to the property. 13*e4a36f41SAndroid Build Coastguard Workerallow mtectrl misc_block_device:blk_file rw_file_perms; 14*e4a36f41SAndroid Build Coastguard Workerallow mtectrl block_device:dir r_dir_perms; 15*e4a36f41SAndroid Build Coastguard Workerread_fstab(mtectrl) 16*e4a36f41SAndroid Build Coastguard Worker 17*e4a36f41SAndroid Build Coastguard Worker# bootloader_message tries to find the fstab in the device config path first, 18*e4a36f41SAndroid Build Coastguard Worker# but because we've already booted up we can use the ro.boot properties instead, 19*e4a36f41SAndroid Build Coastguard Worker# so we can just ignore the SELinux denial. 20*e4a36f41SAndroid Build Coastguard Workerdontaudit mtectrl sysfs_dt_firmware_android:dir search; 21*e4a36f41SAndroid Build Coastguard Workerdontaudit mtectrl vendor_property_type:file read; 22