From 9a40702a46fd46d0b4dbb11555359a037adb63ec Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Mon, 13 Jan 2014 14:03:47 -0500
Subject: [PATCH] Allow recovery to execute ashmem_device and tmpfs.

Requires execmem and ashmem_device:chr_file execute similar to bootanim
presumably for the display.

Did not see any cache_file execute denials and do not see any
exec of /cache files in the code, only reading/interpreting scripts,
so I removed cache_file rx_file_perms.

Did not see any tmpfs execute denials in /proc/last_kmsg but the
source code appears to extract the update-binary to a tmpfs mount
in /tmp and then exec it.  So I retained that rule.

Tested with adb sideload.

Change-Id: I8ca5f2cd390be1adf063f16e6280cc4cd1833c0e
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
 recovery.te | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/recovery.te b/recovery.te
index a52b2b546..31c92c556 100644
--- a/recovery.te
+++ b/recovery.te
@@ -8,4 +8,5 @@ allow recovery {fs_type dev_type -kmem_device file_type}:dir_file_class_set rela
 allow recovery unlabeled:filesystem mount;
 
 allow recovery self:process execmem;
-allow recovery cache_file:file rx_file_perms;
+allow recovery ashmem_device:file execute;
+allow recovery tmpfs:file rx_file_perms;
-- 
GitLab