Grant update_engine access to device-specific partitions
Without those permissions OTA updates will work via sideloading only,
but not via the system update client (e.g., GMS/GOTA).
Issue: FP3-A11#381
Change-Id: I8f280489f4ab9800af80c426d1cf7f8d0afeadfb
diff --git a/sepolicy/vendor/update_engine.te b/sepolicy/vendor/update_engine.te
new file mode 100644
index 0000000..0aa5ab4
--- /dev/null
+++ b/sepolicy/vendor/update_engine.te
@@ -0,0 +1,12 @@
+# Allow update_engine and update_engine_sideload (recovery) read/write on the
+# device-specific partitions it should update.
+allow update_engine {
+ boot_block_device
+ custom_ab_block_device
+ mdtp_device
+ modem_block_device
+ xbl_block_device
+}:blk_file rw_file_perms;
+
+allow update_engine firmware_file:filesystem getattr;
+allow update_engine self:capability kill;