667f2a4670
Previously, we rely on mount points to copy files out of efs partitions. Switch over to dump.f2fs to read directly from block device without mounting. This allows us to copy files out of efs partition in both 4K and 16K mode. Test: Boot ext4 device with dev option enabled Bug: 340965747 Change-Id: Ie3108319cfdb5d922a18863de7431c3cfcc4cf16
60 lines
2.6 KiB
Text
60 lines
2.6 KiB
Text
type copy_efs_files_to_data, domain;
|
|
type copy_efs_files_to_data_exec, exec_type, vendor_file_type, file_type;
|
|
|
|
init_daemon_domain(copy_efs_files_to_data);
|
|
|
|
|
|
|
|
# Allow creating files on /data/vendor/copied
|
|
allow copy_efs_files_to_data modem_efs_image_file:dir { create_dir_perms };
|
|
allow copy_efs_files_to_data modem_efs_image_file:file { create_file_perms };
|
|
allow copy_efs_files_to_data modem_efs_image_file:lnk_file { create_file_perms };
|
|
|
|
|
|
# Allow execute binaries from /vendor/bin
|
|
allow copy_efs_files_to_data vendor_toolbox_exec:file rx_file_perms;
|
|
allow copy_efs_files_to_data vendor_shell_exec:file rx_file_perms;
|
|
|
|
# Allow execute /vendor/bin/dump.f2fs
|
|
allow copy_efs_files_to_data vendor_file:file { getattr execute_no_trans };
|
|
|
|
# Allow execute dump.f2fs to dump files from /dev/block/by-name/efs
|
|
allow copy_efs_files_to_data block_device:dir search;
|
|
allow copy_efs_files_to_data efs_block_device:blk_file r_file_perms;
|
|
allow copy_efs_files_to_data modem_userdata_block_device:blk_file r_file_perms;
|
|
allow copy_efs_files_to_data persist_block_device:blk_file r_file_perms;
|
|
|
|
# Allow checking if /data/vendor/copied/[efs/efs_backup/persist] exist
|
|
allow copy_efs_files_to_data modem_efs_file:dir getattr;
|
|
allow copy_efs_files_to_data modem_userdata_file:dir getattr;
|
|
allow copy_efs_files_to_data persist_file:dir getattr;
|
|
|
|
|
|
allow copy_efs_files_to_data sysfs_scsi_devices_0000:dir r_dir_perms;
|
|
allow copy_efs_files_to_data sysfs_scsi_devices_0000:file r_file_perms;
|
|
|
|
# dump.f2fs need to restore file permissions after dumping
|
|
# files from an f2fs image
|
|
allow copy_efs_files_to_data self:capability chown;
|
|
allow copy_efs_files_to_data self:capability fowner;
|
|
|
|
|
|
allow copy_efs_files_to_data kmsg_debug_device:chr_file { w_file_perms ioctl getattr };
|
|
|
|
|
|
|
|
# Should not write to any block devices. Only read from block device
|
|
# and dump files to /data/vendor/copied
|
|
dontaudit copy_efs_files_to_data dev_type:blk_file write;
|
|
# Setting xattr requires sys_admin
|
|
dontaudit copy_efs_files_to_data self:capability sys_admin;
|
|
# dump.f2fs would attempt to restore selinux on dumped files, but we
|
|
# will use restorecon to do the job.
|
|
dontaudit copy_efs_files_to_data modem_efs_image_file:dir relabelfrom;
|
|
dontaudit copy_efs_files_to_data modem_efs_image_file:file relabelfrom;
|
|
dontaudit copy_efs_files_to_data modem_efs_file:dir relabelto;
|
|
dontaudit copy_efs_files_to_data modem_efs_file:file relabelto;
|
|
dontaudit copy_efs_files_to_data modem_userdata_file:dir relabelto;
|
|
dontaudit copy_efs_files_to_data modem_userdata_file:file relabelto;
|
|
dontaudit copy_efs_files_to_data vendor_persist_type:dir relabelto;
|
|
dontaudit copy_efs_files_to_data vendor_persist_type:file relabelto;
|