xref: /aosp_15_r20/system/sepolicy/prebuilts/api/31.0/private/snapuserd.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)
1*e4a36f41SAndroid Build Coastguard Worker# snapuserd - Daemon for servicing dm-user requests for Virtual A/B snapshots.
2*e4a36f41SAndroid Build Coastguard Workertype snapuserd, domain;
3*e4a36f41SAndroid Build Coastguard Workertype snapuserd_exec, exec_type, file_type, system_file_type;
4*e4a36f41SAndroid Build Coastguard Worker
5*e4a36f41SAndroid Build Coastguard Workertypeattribute snapuserd coredomain;
6*e4a36f41SAndroid Build Coastguard Worker
7*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(snapuserd)
8*e4a36f41SAndroid Build Coastguard Worker
9*e4a36f41SAndroid Build Coastguard Workerallow snapuserd kmsg_device:chr_file rw_file_perms;
10*e4a36f41SAndroid Build Coastguard Worker
11*e4a36f41SAndroid Build Coastguard Worker# Reading and writing to /dev/block/dm-* (device-mapper) nodes.
12*e4a36f41SAndroid Build Coastguard Workerallow snapuserd block_device:dir r_dir_perms;
13*e4a36f41SAndroid Build Coastguard Workerallow snapuserd dm_device:chr_file rw_file_perms;
14*e4a36f41SAndroid Build Coastguard Workerallow snapuserd dm_device:blk_file rw_file_perms;
15*e4a36f41SAndroid Build Coastguard Worker
16*e4a36f41SAndroid Build Coastguard Worker# Reading and writing to dm-user control nodes.
17*e4a36f41SAndroid Build Coastguard Workerallow snapuserd dm_user_device:dir r_dir_perms;
18*e4a36f41SAndroid Build Coastguard Workerallow snapuserd dm_user_device:chr_file rw_file_perms;
19*e4a36f41SAndroid Build Coastguard Worker
20*e4a36f41SAndroid Build Coastguard Worker# Reading and writing to /dev/socket/snapuserd.
21*e4a36f41SAndroid Build Coastguard Workerallow snapuserd snapuserd_socket:unix_stream_socket { accept listen getattr read write };
22*e4a36f41SAndroid Build Coastguard Worker
23*e4a36f41SAndroid Build Coastguard Worker# This arises due to first-stage init opening /dev/null without F_CLOEXEC
24*e4a36f41SAndroid Build Coastguard Worker# (see SetStdioToDevNull in init). When we fork() and execveat() snapuserd
25*e4a36f41SAndroid Build Coastguard Worker# again, the descriptor leaks into the new process.
26*e4a36f41SAndroid Build Coastguard Workerallow snapuserd kernel:fd use;
27