1*e4a36f41SAndroid Build Coastguard Worker# snapuserd - Daemon for servicing dm-user requests for Virtual A/B snapshots. 2*e4a36f41SAndroid Build Coastguard Workertype snapuserd, domain; 3*e4a36f41SAndroid Build Coastguard Workertype snapuserd_exec, exec_type, file_type, system_file_type; 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Workertypeattribute snapuserd coredomain; 6*e4a36f41SAndroid Build Coastguard Worker 7*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(snapuserd) 8*e4a36f41SAndroid Build Coastguard Worker 9*e4a36f41SAndroid Build Coastguard Workerallow snapuserd kmsg_device:chr_file rw_file_perms; 10*e4a36f41SAndroid Build Coastguard Worker 11*e4a36f41SAndroid Build Coastguard Worker# Reading and writing to /dev/block/dm-* (device-mapper) nodes. 12*e4a36f41SAndroid Build Coastguard Workerallow snapuserd block_device:dir r_dir_perms; 13*e4a36f41SAndroid Build Coastguard Workerallow snapuserd dm_device:chr_file rw_file_perms; 14*e4a36f41SAndroid Build Coastguard Workerallow snapuserd dm_device:blk_file rw_file_perms; 15*e4a36f41SAndroid Build Coastguard Worker 16*e4a36f41SAndroid Build Coastguard Worker# Reading and writing to dm-user control nodes. 17*e4a36f41SAndroid Build Coastguard Workerallow snapuserd dm_user_device:dir r_dir_perms; 18*e4a36f41SAndroid Build Coastguard Workerallow snapuserd dm_user_device:chr_file rw_file_perms; 19*e4a36f41SAndroid Build Coastguard Worker 20*e4a36f41SAndroid Build Coastguard Worker# Reading and writing to /dev/socket/snapuserd. 21*e4a36f41SAndroid Build Coastguard Workerallow snapuserd snapuserd_socket:unix_stream_socket { accept listen getattr read write }; 22*e4a36f41SAndroid Build Coastguard Worker 23*e4a36f41SAndroid Build Coastguard Worker# This arises due to first-stage init opening /dev/null without F_CLOEXEC 24*e4a36f41SAndroid Build Coastguard Worker# (see SetStdioToDevNull in init). When we fork() and execveat() snapuserd 25*e4a36f41SAndroid Build Coastguard Worker# again, the descriptor leaks into the new process. 26*e4a36f41SAndroid Build Coastguard Workerallow snapuserd kernel:fd use; 27