# This file contains Brillo-specific SELinux policy for
# update_engine. For the main update_engine policy, see
# external/sepolicy/update_engine.te

# Allow update_engine to use D-Bus.
unix_socket_connect(update_engine, dbus_daemon, dbus_daemon)

# Allow using metrics_lib.
allow_metrics_reporting(update_engine)

# Allow hosting of the binder service.
allow update_engine update_engine_service:service_manager { add find };

# Allow read/write on misc partition. This can be removed when we're no
# longer using the boot_control_copy implementation of the boot_control
# HAL.
allow update_engine misc_block_device:blk_file rw_file_perms;

# Allow reading os-release.d properties.
r_dir_file(update_engine, os_release_file);

# Allow crash_reporter access to core dump files.
allow_crash_reporter(update_engine)

# Allow update_engine to talk to weaved over binder.
allow_call_weave(update_engine)