| # mtectrl is a tool to request MTE (Memory Tagging Extensions) from the bootloader. |
| type mtectrl, domain, coredomain; |
| type mtectrl_exec, system_file_type, exec_type, file_type; |
| |
| init_daemon_domain(mtectrl) |
| |
| # to set the sys prop to match the bootloader message state. |
| set_prop(mtectrl, arm64_memtag_prop) |
| |
| # mtectrl communicates the request to the bootloader via the misc partition. |
| # needs to write to update the request in misc partition, and read to sync |
| # back to the property. |
| allow mtectrl misc_block_device:blk_file rw_file_perms; |
| allow mtectrl block_device:dir r_dir_perms; |
| read_fstab(mtectrl) |
| |
| # bootloader_message tries to find the fstab in the device config path first, |
| # but because we've already booted up we can use the ro.boot properties instead, |
| # so we can just ignore the SELinux denial. |
| dontaudit mtectrl sysfs_dt_firmware_android:dir search; |
| dontaudit mtectrl vendor_property_type:file read; |
