From 6c3f2831aca571ec3b01f60996965a432aa8164d Mon Sep 17 00:00:00 2001
From: Tao Bao <tbao@google.com>
Date: Tue, 24 May 2016 21:07:48 -0700
Subject: [PATCH] Add ota_package_file label for OTA packages.
Allow priv_app, uncrypt, update_engine to access the OTA packages at
/data/ota_package (both A/B and non-A/B). GMSCore (priv_app) checks
the existence of the folder, and downloads the package there if present.
Bug: 28944800
Change-Id: I3c0717861fce7f93b33874a99f6a4a55567612a5
---
file.te | 2 ++
file_contexts | 1 +
priv_app.te | 4 ++++
uncrypt.te | 4 ++++
update_engine.te | 4 ++++
5 files changed, 15 insertions(+)
diff --git a/file.te b/file.te
index d2894ffd9..651078b88 100644
--- a/file.te
+++ b/file.te
@@ -91,6 +91,8 @@ type apk_private_tmp_file, file_type, data_file_type, mlstrustedobject;
type dalvikcache_data_file, file_type, data_file_type;
# /data/ota
type ota_data_file, file_type, data_file_type;
+# /data/ota_package
+type ota_package_file, file_type, data_file_type, mlstrustedobject;
# /data/misc/profiles
type user_profile_data_file, file_type, data_file_type, mlstrustedobject;
type user_profile_foreign_dex_data_file, file_type, data_file_type, mlstrustedobject;
diff --git a/file_contexts b/file_contexts
index 0192ea3cd..33b840b63 100644
--- a/file_contexts
+++ b/file_contexts
@@ -246,6 +246,7 @@
/data/resource-cache(/.*)? u:object_r:resourcecache_data_file:s0
/data/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0
/data/ota(/.*)? u:object_r:ota_data_file:s0
+/data/ota_package(/.*)? u:object_r:ota_package_file:s0
/data/adb(/.*)? u:object_r:adb_data_file:s0
/data/anr(/.*)? u:object_r:anr_data_file:s0
/data/app(/.*)? u:object_r:apk_data_file:s0
diff --git a/priv_app.te b/priv_app.te
index d380a67a2..85516a6e1 100644
--- a/priv_app.te
+++ b/priv_app.te
@@ -45,6 +45,10 @@ allow priv_app mnt_media_rw_file:dir search;
allow priv_app { cache_file cache_recovery_file }:dir create_dir_perms;
allow priv_app { cache_file cache_recovery_file }:file create_file_perms;
+# Write to /data/ota_package for OTA packages.
+allow priv_app ota_package_file:dir rw_dir_perms;
+allow priv_app ota_package_file:file create_file_perms;
+
# Access to /data/media.
allow priv_app media_rw_data_file:dir create_dir_perms;
allow priv_app media_rw_data_file:file create_file_perms;
diff --git a/uncrypt.te b/uncrypt.te
index c8840dd6d..2d95b8825 100644
--- a/uncrypt.te
+++ b/uncrypt.te
@@ -19,6 +19,10 @@ userdebug_or_eng(`
allow uncrypt cache_recovery_file:dir rw_dir_perms;
allow uncrypt cache_recovery_file:file create_file_perms;
+# Read OTA zip file at /data/ota_package/.
+allow uncrypt ota_package_file:dir r_dir_perms;
+allow uncrypt ota_package_file:file r_file_perms;
+
# Write to /dev/socket/uncrypt
unix_socket_connect(uncrypt, uncrypt, uncrypt)
diff --git a/update_engine.te b/update_engine.te
index 33e81342a..c5786928e 100644
--- a/update_engine.te
+++ b/update_engine.te
@@ -56,3 +56,7 @@ allow update_engine update_engine_service:service_manager { add };
# Allow update_engine to call the callback function provided by priv_app.
binder_call(update_engine, priv_app)
+
+# Read OTA zip file at /data/ota_package/.
+allow update_engine ota_package_file:file r_file_perms;
+allow update_engine ota_package_file:dir r_dir_perms;
--
GitLab