replicant-vendor_replicant/sepolicy/system_app.te

# For the updaters
allow system_app recovery_cache_file:dir create_dir_perms;
allow system_app recovery_cache_file:file create_file_perms;
allow system_app media_rw_data_file:dir create_dir_perms;
allow system_app media_rw_data_file:file create_file_perms;

# Boot animation
allow system_app ctl_bootanim_prop:property_service set;
sepolicy: Split off /cache/recovery's permissions /cache/recovery is used by 2 domains: recovery and updater apps. Separate its perms from the rest of /cache and grant them to those 2 clients Change-Id: Iacde60744c07423f9876c2f8e3da900543e38ddf 2015-02-05 22:33:47 +00:00			`# For the updaters`
sepolicy: Allow system apps to write cache and media files Updaters need to be able to read and write to these locations. Change-Id: I928a5f73ec29ab4fecb717072532d449192f3ca9 2015-02-18 01:36:37 +00:00			`allow system_app recovery_cache_file:dir create_dir_perms;`
			`allow system_app recovery_cache_file:file create_file_perms;`
			`allow system_app media_rw_data_file:dir create_dir_perms;`
			`allow system_app media_rw_data_file:file create_file_perms;`
sepolicy: Allow system app to set boot anim property Addresses denials observerd when using QuickBoot: <4>[ 224.756971] avc: denied { set } for property=ctl.bootanim scontext=u:r:system_app:s0 tcontext=u:object_r:ctl_bootanim_prop:s0 tclass=property_service <3>[ 224.757094] init: sys_prop: Unable to start service ctl [bootanim] uid:1000 gid:1000 pid:6039 <4>[ 226.306456] avc: denied { set } for property=ctl.bootanim scontext=u:r:system_app:s0 tcontext=u:object_r:ctl_bootanim_prop:s0 tclass=property_service Change-Id: I338a0a1d5fa12c10e413769ea9638c10ed137000 2015-09-21 14:38:54 +00:00
			`# Boot animation`
			`allow system_app ctl_bootanim_prop:property_service set;`