xref: /aosp_15_r20/system/sepolicy/private/update_engine_common.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)

# update_engine payload application permissions. These are shared between the
# background daemon and the recovery tool to sideload an update.

# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
# The postinstall program is run by update_engine_common and must be tagged
# with postinstall_exec in the new filesystem.
# TODO Have build system attempt to verify this
domain_auto_trans(update_engine_common, postinstall_exec, postinstall)

# Vendor directories can have the transition as well during OTA. This is caused
# by update_engine execing scripts in vendor to perform any update tasks needed
# there.
domain_auto_trans(update_engine_common, postinstall_file, postinstall)

# Allow update_engine to reach block devices in /dev/block.
allow update_engine_common block_device:dir search;

# Allow read/write on system and boot partitions.
allow update_engine_common boot_block_device:blk_file rw_file_perms;
allow update_engine_common system_block_device:blk_file rw_file_perms;

# Where ioctls are granted via standard allow rules to block devices,
# automatically allow common ioctls that are generally needed by
# update_engine.
allowxperm update_engine_common dev_type:blk_file ioctl {
  BLKDISCARD
  BLKDISCARDZEROES
  BLKROGET
  BLKROSET
  BLKSECDISCARD
  BLKZEROOUT
};

# Allow to set recovery options in the BCB. Used to trigger factory reset when
# the update to an older version (channel change) or incompatible version
# requires it.
allow update_engine_common misc_block_device:blk_file rw_file_perms;

# read fstab
allow update_engine_common rootfs:dir getattr;
allow update_engine_common rootfs:file r_file_perms;

# Allow update_engine_common to mount on the /postinstall directory and reset the
# labels on the mounted filesystem to postinstall_file.
allow update_engine_common postinstall_mnt_dir:dir { mounton getattr search };
allow update_engine_common postinstall_file:filesystem { mount unmount relabelfrom relabelto };
allow update_engine_common labeledfs:filesystem { mount unmount relabelfrom };

# Allow update_engine_common to read and execute postinstall_file.
allow update_engine_common postinstall_file:file rx_file_perms;
allow update_engine_common postinstall_file:lnk_file r_file_perms;
allow update_engine_common postinstall_file:dir r_dir_perms;

# install update.zip from cache
r_dir_file(update_engine_common, cache_file)

# A postinstall program is typically a shell script (with a #!), so we allow
# to execute those.
allow update_engine_common shell_exec:file rx_file_perms;

# Allow update_engine_common to suspend, resume and kill the postinstall program.
allow update_engine_common postinstall:process { signal sigstop sigkill };

# access /proc/cmdline
allow update_engine_common proc_cmdline:file r_file_perms;

# Read files in /sys/firmware/devicetree/base/firmware/android/
r_dir_file(update_engine_common, sysfs_dt_firmware_android)

# Needed because libdm reads sysfs to validate when a dm path is ready.
r_dir_file(update_engine_common, sysfs_dm)

# Scan files in /sys/fs/ext4 and /sys/fs/f2fs for device-mapper diagnostics.
allow update_engine_common sysfs:dir r_dir_perms;
allow update_engine_common sysfs_fs_f2fs:dir r_dir_perms;

# read / write on /dev/device-mapper to map / unmap devices
allow update_engine_common dm_device:chr_file rw_file_perms;

# apply / verify updates on devices mapped via device mapper
allow update_engine_common dm_device:blk_file rw_file_perms;

# read /dev/dm-user, so that we can inotify wait for control devices to be
# asynchronously created by ueventd.
allow update_engine dm_user_device:dir r_dir_perms;
allow update_engine dm_user_device:chr_file r_file_perms;

# read / write metadata on super device to resize partitions
allow update_engine_common super_block_device_type:blk_file rw_file_perms;

# ioctl on super device to get block device alignment and alignment offset
allowxperm update_engine_common super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF };

# get physical block device to map logical partitions on device mapper
allow update_engine_common block_device:dir r_dir_perms;

# Allow update_engine_common to write to statsd socket.
unix_socket_send(update_engine_common, statsdw, statsd)

# Allow to read Virtual A/B feature flags.
get_prop(update_engine_common, virtual_ab_prop)

# Allow to read GKI related flags.
get_prop(update_engine_common, ab_update_gki_prop)
get_prop(update_engine_common, build_bootimage_prop)

# Allow to read/write/create OTA metadata files for snapshot status and COW file status.
allow update_engine_common metadata_file:dir search;
allow update_engine_common ota_metadata_file:dir { rw_dir_perms rmdir };
allow update_engine_common ota_metadata_file:file create_file_perms;