commit 35e50159ad8392362910a9e33d76047d22682f04
author Paul Lawrence <paullawrence@google.com> Fri Apr 10 07:42:32 2015 -0700
committer Paul Lawrence <paullawrence@google.com> Fri May 29 17:50:12 2015 +0000
tree 148e80a28a24b5ba5dc1ce388404820f51a91636
parent e2c0c9de7b99ed5cd2349e0585284fd6a0ad768a

DO NOT MERGE New ext4enc kernel switching from xattrs to ioctl

(cherry-picked from change f7163597f595435f90f4f50cfae38ef0dd01a21b)

This is one of three changes to enable this functionality:
  https://android-review.googlesource.com/#/c/146259/
  https://android-review.googlesource.com/#/c/146264/
  https://android-review.googlesource.com/#/c/146265/

Bug: 18151196

Change-Id: I6ce4bc977a548df93ea5c09430f93eef5ee1f9fa

init.te

diff --git a/init.te b/init.te
index 89ddac7..3af01fb 100644
--- a/init.te
+++ b/init.te
@@ -96,7 +96,7 @@
 # init.<board>.rc files often include device-specific types, so
 # we just allow all file types except /system files here.
 allow init self:capability { chown fowner fsetid };
-allow init {file_type -system_file -exec_type -app_data_file}:dir { create search getattr open read setattr };
+allow init {file_type -system_file -exec_type -app_data_file}:dir { create search getattr open read setattr ioctl };
 allow init {file_type -system_file -exec_type -keystore_data_file -security_file -app_data_file -shell_data_file -vold_data_file}:dir { write add_name remove_name rmdir relabelfrom };
 allow init {file_type -system_file -exec_type -keystore_data_file -security_file -app_data_file -shell_data_file -vold_data_file}:file { create getattr open read write setattr relabelfrom unlink };
 allow init {file_type -system_file -exec_type -keystore_data_file -security_file -app_data_file -shell_data_file -vold_data_file}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink };

keystore.te

diff --git a/keystore.te b/keystore.te
index 3561fed..83a0e85 100644
--- a/keystore.te
+++ b/keystore.te
@@ -23,7 +23,7 @@
 ### Protect ourself from others
 ###
 
-neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto };
+neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
 neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relabelto getattr };
 
 neverallow { domain -keystore -init } keystore_data_file:dir *;

vold.te

diff --git a/vold.te b/vold.te
index 6a8d82f..9ab00c7 100644
--- a/vold.te
+++ b/vold.te
@@ -155,7 +155,7 @@
 allow vold init:key { write search setattr };
 allow vold vold:key { write search setattr };
 
-neverallow { domain -vold } vold_data_file:dir ~{ open create read getattr setattr search relabelto };
+neverallow { domain -vold } vold_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
 neverallow { domain -vold } vold_data_file:notdevfile_class_set ~{ relabelto getattr };
 neverallow { domain -vold -init } vold_data_file:dir *;
 neverallow { domain -vold -init } vold_data_file:notdevfile_class_set *;