1*e4a36f41SAndroid Build Coastguard Workertypeattribute update_verifier coredomain; 2*e4a36f41SAndroid Build Coastguard Worker 3*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(update_verifier) 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Worker# Allow update_verifier to reboot the device. 6*e4a36f41SAndroid Build Coastguard Workerset_prop(update_verifier, powerctl_prop) 7*e4a36f41SAndroid Build Coastguard Worker 8*e4a36f41SAndroid Build Coastguard Worker# Allow to set the OTA related properties e.g. ota.warm_reset. 9*e4a36f41SAndroid Build Coastguard Workerset_prop(update_verifier, ota_prop) 10*e4a36f41SAndroid Build Coastguard Worker 11*e4a36f41SAndroid Build Coastguard Worker# allow update_verifier to connect to snapuserd daemon 12*e4a36f41SAndroid Build Coastguard Workerallow update_verifier snapuserd_socket:sock_file write; 13*e4a36f41SAndroid Build Coastguard Workerallow update_verifier snapuserd:unix_stream_socket connectto; 14*e4a36f41SAndroid Build Coastguard Worker 15*e4a36f41SAndroid Build Coastguard Worker# virtual a/b properties 16*e4a36f41SAndroid Build Coastguard Workerget_prop(update_verifier, virtual_ab_prop) 17*e4a36f41SAndroid Build Coastguard Worker 18*e4a36f41SAndroid Build Coastguard Worker# Allow update_verifier to reach block devices in /dev/block. 19*e4a36f41SAndroid Build Coastguard Workerallow update_verifier block_device:dir search; 20*e4a36f41SAndroid Build Coastguard Worker 21*e4a36f41SAndroid Build Coastguard Worker# Read care map in /data/ota_package/. 22*e4a36f41SAndroid Build Coastguard Workerallow update_verifier ota_package_file:dir r_dir_perms; 23*e4a36f41SAndroid Build Coastguard Workerallow update_verifier ota_package_file:file r_file_perms; 24*e4a36f41SAndroid Build Coastguard Worker 25*e4a36f41SAndroid Build Coastguard Worker# Read /sys/block to find all the DM directories like (/sys/block/dm-X). 26*e4a36f41SAndroid Build Coastguard Workerallow update_verifier sysfs:dir r_dir_perms; 27*e4a36f41SAndroid Build Coastguard Worker 28*e4a36f41SAndroid Build Coastguard Worker# Read /sys/block/dm-X/dm/name (which is a symlink to 29*e4a36f41SAndroid Build Coastguard Worker# /sys/devices/virtual/block/dm-X/dm/name) to identify the mapping between 30*e4a36f41SAndroid Build Coastguard Worker# dm-X and system/vendor partitions. 31*e4a36f41SAndroid Build Coastguard Workerallow update_verifier sysfs_dm:dir r_dir_perms; 32*e4a36f41SAndroid Build Coastguard Workerallow update_verifier sysfs_dm:file r_file_perms; 33*e4a36f41SAndroid Build Coastguard Worker 34*e4a36f41SAndroid Build Coastguard Worker# Read all blocks in DM wrapped system partition. 35*e4a36f41SAndroid Build Coastguard Workerallow update_verifier dm_device:blk_file r_file_perms; 36*e4a36f41SAndroid Build Coastguard Worker 37*e4a36f41SAndroid Build Coastguard Worker# Write to kernel message. 38*e4a36f41SAndroid Build Coastguard Workerallow update_verifier kmsg_device:chr_file { getattr w_file_perms }; 39*e4a36f41SAndroid Build Coastguard Worker 40*e4a36f41SAndroid Build Coastguard Worker# Use Boot Control HAL 41*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(update_verifier, hal_bootctl) 42*e4a36f41SAndroid Build Coastguard Worker 43*e4a36f41SAndroid Build Coastguard Worker# Access Checkpoint commands over binder 44*e4a36f41SAndroid Build Coastguard Workerallow update_verifier vold_service:service_manager find; 45*e4a36f41SAndroid Build Coastguard Workerbinder_call(update_verifier, servicemanager) 46*e4a36f41SAndroid Build Coastguard Workerbinder_call(update_verifier, vold) 47