commit 946cfd785d46fe9d055baa511f15a3f05ca38d66
author Steve Kondik <steve@cyngn.com> Sun Sep 06 13:53:29 2015 -0700
committer Josue Rivera <prbassplayer@gmail.com> Mon Sep 21 00:35:24 2015 +0200
tree e1ee64cca69b8a467ca4afba9b670dccf7e7b85d
parent 422b92ae93a09a236a7b87387227326fec52ce0e

cm: SELinux policy for persistent properties API

 * Set up persistent properties for devices with a /persist partition.

Change-Id: I78974dd4e25831338462c91fc25e36e343795510

prebuilt/common/etc/init.local.rc

diff --git a/prebuilt/common/etc/init.local.rc b/prebuilt/common/etc/init.local.rc
index f58e592..5345610 100644
--- a/prebuilt/common/etc/init.local.rc
+++ b/prebuilt/common/etc/init.local.rc
@@ -31,6 +31,9 @@
     setprop net.tcp.usercfg.wifi       1
     setprop net.tcp.usercfg.lte        1
 
+    # Persistent properties (only created if persist exists)
+    mkdir /persist/properties 0770 system system
+
 # adb over network
 on property:service.adb.tcp.port=5555
     stop adbd

sepolicy/file.te

diff --git a/sepolicy/file.te b/sepolicy/file.te
index 4bbe1b5..a07d48a 100644
--- a/sepolicy/file.te
+++ b/sepolicy/file.te
@@ -8,3 +8,6 @@
 
 # Recovery's "cache"
 type recovery_cache_file, file_type, mlstrustedobject;
+
+# Persistent property storage
+type persist_property_file, file_type;

sepolicy/file_contexts

diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index 6a3969b..4e53379 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -31,3 +31,6 @@
 
 # Lockscreen wallpaper
 /data/system/users/[0-9]+/keyguard_wallpaper   u:object_r:wallpaper_file:s0
+
+# Persistent properties
+/persist/properties         u:object_r:persist_property_file:s0

sepolicy/system_server.te

diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te
index 4728a44..b6a65ee 100644
--- a/sepolicy/system_server.te
+++ b/sepolicy/system_server.te
@@ -1,2 +1,6 @@
 allow system_server recovery_cache_file:dir rw_dir_perms;
 allow system_server recovery_cache_file:file create_file_perms;
+
+# Persistent properties
+allow system_server persist_property_file:dir rw_dir_perms;
+allow system_server persist_property_file:file { create_file_perms unlink };