am 4a407d5e: Allow recovery to create device nodes and modify rootfs automerge: de84e45 automerge: 9ed758f
* commit '4a407d5ecf7d465c0d1609777d56991c2f9608a5':
Allow recovery to create device nodes and modify rootfs
diff --git a/BoardConfigCommon.mk b/BoardConfigCommon.mk
index 064b98b..e8625d1 100644
--- a/BoardConfigCommon.mk
+++ b/BoardConfigCommon.mk
@@ -99,6 +99,7 @@
recovery.te \
rild.te \
sensors_config.te \
+ setup_fs.te \
surfaceflinger.te \
system_app.te \
system_server.te \
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index fe30a49..ee1187a 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -23,9 +23,16 @@
/system/bin/brcm_patchram_plus -- u:object_r:hci_attach_exec:s0
/system/bin/glgps -- u:object_r:gpsd_exec:s0
/system/bin/sensors-config -- u:object_r:sensors_config_exec:s0
+/system/bin/setup_fs -- u:object_r:setup_fs_exec:s0
/sys/devices/tegradc\.0(/.*)? u:object_r:sysfs_devices_tegradc:s0
/sys/devices/tegradc\.1(/.*)? u:object_r:sysfs_devices_tegradc:s0
/sys/devices/platform/tegra-i2c.1/i2c-1/1-0010/update_fw -- u:object_r:sysfs_firmware_writable:s0
/sys/devices/platform/bcm4330_rfkill/rfkill/rfkill0/state -- u:object_r:sysfs_bluetooth_writable:s0
/sys/devices/platform/bcm4330_rfkill/rfkill/rfkill0/type -- u:object_r:sysfs_bluetooth_writable:s0
+
+/dev/block/platform/sdhci-tegra\.3/by-name/APP u:object_r:system_block_device:s0
+/dev/block/platform/sdhci-tegra\.3/by-name/SOS u:object_r:recovery_block_device:s0
+/dev/block/platform/sdhci-tegra\.3/by-name/UDA u:object_r:userdata_block_device:s0
+/dev/block/platform/sdhci-tegra\.3/by-name/CAC u:object_r:cache_block_device:s0
+/dev/block/platform/sdhci-tegra\.3/by-name/MDA u:object_r:metadata_block_device:s0
diff --git a/sepolicy/setup_fs.te b/sepolicy/setup_fs.te
new file mode 100644
index 0000000..b4dc67b
--- /dev/null
+++ b/sepolicy/setup_fs.te
@@ -0,0 +1,11 @@
+# setup_fs
+# Set up an ext4 filesystem on one or more block devices.
+type setup_fs, domain;
+type setup_fs_exec, exec_type, file_type;
+permissive_or_unconfined(setup_fs)
+
+init_daemon_domain(setup_fs)
+
+allow setup_fs block_device:dir search;
+allow setup_fs userdata_block_device:blk_file rw_file_perms;
+allow setup_fs cache_block_device:blk_file rw_file_perms;
