1type dlkm_loader, domain;
2type dlkm_loader_exec, exec_type, vendor_file_type, file_type;
3
4init_daemon_domain(dlkm_loader)
5
6# Allow insmod on vendor, system and system_dlkm partitions
7allow dlkm_loader self:capability sys_module;
8allow dlkm_loader system_dlkm_file:dir r_dir_perms;
9allow dlkm_loader system_dlkm_file:file r_file_perms;
10allow dlkm_loader system_dlkm_file:system module_load;
11allow dlkm_loader system_file:system module_load;
12allow dlkm_loader vendor_file:system module_load;
13
14# needed for libmodprobe to read kernel commandline
15allow dlkm_loader proc_cmdline:file r_file_perms;
16
17# Needed because CONFIG_USB_DUMMY_HCD adds some additional logic to
18# finit_module() syscall, causing that syscall to create/update keyrings.
19# Once we remove CONFIG_USB_DUMMY_HCD config, self:key write permission can be
20# removed.
21allow dlkm_loader self:key write;
22
23# Needed because CONFIG_DMABUF_HEAPS_DEFERRED_FREE calls sched_set_normal()
24# in its module_init() function, which is attributed to dlkm_loader.
25allow dlkm_loader kernel:process setsched;
26allow dlkm_loader self:capability sys_nice;
27
28# Allow writing to kernel log
29allow dlkm_loader kmsg_device:chr_file rw_file_perms;
30
31# dlkm_loader searches tracefs while looking for modules
32dontaudit dlkm_loader debugfs_bootreceiver_tracing:dir search;
33dontaudit dlkm_loader debugfs_mm_events_tracing:dir search;
34
35set_prop(dlkm_loader, vendor_device_prop)
36