1# update_engine payload application permissions. These are shared between the
2# background daemon and the recovery tool to sideload an update.
3
4# Allow update_engine to reach block devices in /dev/block.
5allow update_engine_common block_device:dir search;
6
7# Allow read/write on system and boot partitions.
8allow update_engine_common boot_block_device:blk_file rw_file_perms;
9allow update_engine_common system_block_device:blk_file rw_file_perms;
10
11# Where ioctls are granted via standard allow rules to block devices,
12# automatically allow common ioctls that are generally needed by
13# update_engine.
14allowxperm update_engine_common dev_type:blk_file ioctl {
15  BLKDISCARD
16  BLKDISCARDZEROES
17  BLKROGET
18  BLKROSET
19  BLKSECDISCARD
20  BLKZEROOUT
21};
22
23# Allow to set recovery options in the BCB. Used to trigger factory reset when
24# the update to an older version (channel change) or incompatible version
25# requires it.
26allow update_engine_common misc_block_device:blk_file rw_file_perms;
27
28# read fstab
29allow update_engine_common rootfs:dir getattr;
30allow update_engine_common rootfs:file r_file_perms;
31
32# Allow update_engine_common to mount on the /postinstall directory and reset the
33# labels on the mounted filesystem to postinstall_file.
34allow update_engine_common postinstall_mnt_dir:dir { mounton getattr search };
35allow update_engine_common postinstall_file:filesystem { mount unmount relabelfrom relabelto };
36allow update_engine_common labeledfs:filesystem relabelfrom;
37
38# Allow update_engine_common to read and execute postinstall_file.
39allow update_engine_common postinstall_file:file rx_file_perms;
40allow update_engine_common postinstall_file:lnk_file r_file_perms;
41allow update_engine_common postinstall_file:dir r_dir_perms;
42
43# install update.zip from cache
44r_dir_file(update_engine_common, cache_file)
45
46# A postinstall program is typically a shell script (with a #!), so we allow
47# to execute those.
48allow update_engine_common shell_exec:file rx_file_perms;
49
50# Allow update_engine_common to suspend, resume and kill the postinstall program.
51allow update_engine_common postinstall:process { signal sigstop sigkill };
52
53# access /proc/cmdline
54allow update_engine_common proc_cmdline:file r_file_perms;
55
56# Read files in /sys/firmware/devicetree/base/firmware/android/
57r_dir_file(update_engine_common, sysfs_dt_firmware_android)
58
59# Needed because libdm reads sysfs to validate when a dm path is ready.
60r_dir_file(update_engine_common, sysfs_dm)
61
62# read / write on /dev/device-mapper to map / unmap devices
63allow update_engine_common dm_device:chr_file rw_file_perms;
64
65# apply / verify updates on devices mapped via device mapper
66allow update_engine_common dm_device:blk_file rw_file_perms;
67
68# read / write metadata on super device to resize partitions
69allow update_engine_common super_block_device_type:blk_file rw_file_perms;
70
71# ioctl on super device to get block device alignment and alignment offset
72allowxperm update_engine_common super_block_device_type:blk_file ioctl { BLKIOMIN BLKALIGNOFF };
73
74# get physical block device to map logical partitions on device mapper
75allow update_engine_common block_device:dir r_dir_perms;
76
77# Allow update_engine_common to write to statsd socket.
78unix_socket_send(update_engine_common, statsdw, statsd)
79
80# Allow to read Virtual A/B feature flags.
81get_prop(update_engine_common, virtual_ab_prop)
82
83# Allow to read/write/create OTA metadata files for snapshot status and COW file status.
84allow update_engine_common metadata_file:dir search;
85allow update_engine_common ota_metadata_file:dir rw_dir_perms;
86allow update_engine_common ota_metadata_file:file create_file_perms;
87