Allowing file based ota for devices which cannot update to P as they were
released with File based ota.
Reason for rule relaxation: Samsung has devices using
a file based OTA mechanism which needs to be updgraded to P.
This mechanism was removed from SELinux policy in
commit 7388575591ff2f55afa887851f5d593963b4552f.
Devices which support file based OTA are unable to use dm-verity
protections, and as a result, are more vulnerable to persistence
attacks where filesystem metadata or layout is attacked.
Nobody should be doing writes to /system & vendor
These partitions are intended to be read-only and should never be
modified. Doing so violates important Android security guarantees
and invalidates dm-verity signatures.
Bug: 78441229
Test: policy compiles. Relaxes compile time and CTS assertions
Change-Id: Id6072fcf8e0e39531b3d00ceacb05cea7b8d7b6f
1 file changed
