1*e4a36f41SAndroid Build Coastguard Worker# volume manager 2*e4a36f41SAndroid Build Coastguard Workertype vold, domain; 3*e4a36f41SAndroid Build Coastguard Workertype vold_exec, exec_type, file_type, system_file_type; 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Worker# Read already opened /cache files. 6*e4a36f41SAndroid Build Coastguard Workerallow vold cache_file:dir r_dir_perms; 7*e4a36f41SAndroid Build Coastguard Workerallow vold cache_file:file { getattr read }; 8*e4a36f41SAndroid Build Coastguard Workerallow vold cache_file:lnk_file r_file_perms; 9*e4a36f41SAndroid Build Coastguard Worker 10*e4a36f41SAndroid Build Coastguard Workerr_dir_file(vold, { sysfs_type -sysfs_batteryinfo }) 11*e4a36f41SAndroid Build Coastguard Worker# XXX Label sysfs files with a specific type? 12*e4a36f41SAndroid Build Coastguard Workerallow vold { 13*e4a36f41SAndroid Build Coastguard Worker sysfs # writing to /sys/*/uevent during coldboot. 14*e4a36f41SAndroid Build Coastguard Worker sysfs_devices_block 15*e4a36f41SAndroid Build Coastguard Worker sysfs_dm 16*e4a36f41SAndroid Build Coastguard Worker sysfs_loop # writing to /sys/block/loop*/uevent during coldboot. 17*e4a36f41SAndroid Build Coastguard Worker sysfs_usb 18*e4a36f41SAndroid Build Coastguard Worker sysfs_zram_uevent 19*e4a36f41SAndroid Build Coastguard Worker sysfs_fs_f2fs 20*e4a36f41SAndroid Build Coastguard Worker}:file w_file_perms; 21*e4a36f41SAndroid Build Coastguard Worker 22*e4a36f41SAndroid Build Coastguard Workerr_dir_file(vold, rootfs) 23*e4a36f41SAndroid Build Coastguard Workerr_dir_file(vold, metadata_file) 24*e4a36f41SAndroid Build Coastguard Workerallow vold { 25*e4a36f41SAndroid Build Coastguard Worker proc # b/67049235 processes /proc/<pid>/* files are mislabeled. 26*e4a36f41SAndroid Build Coastguard Worker proc_bootconfig 27*e4a36f41SAndroid Build Coastguard Worker proc_cmdline 28*e4a36f41SAndroid Build Coastguard Worker proc_drop_caches 29*e4a36f41SAndroid Build Coastguard Worker proc_filesystems 30*e4a36f41SAndroid Build Coastguard Worker proc_meminfo 31*e4a36f41SAndroid Build Coastguard Worker proc_mounts 32*e4a36f41SAndroid Build Coastguard Worker}:file r_file_perms; 33*e4a36f41SAndroid Build Coastguard Worker 34*e4a36f41SAndroid Build Coastguard Worker#Get file contexts 35*e4a36f41SAndroid Build Coastguard Workerallow vold file_contexts_file:file r_file_perms; 36*e4a36f41SAndroid Build Coastguard Worker 37*e4a36f41SAndroid Build Coastguard Worker# Allow us to jump into execution domains of above tools 38*e4a36f41SAndroid Build Coastguard Workerallow vold self:process setexec; 39*e4a36f41SAndroid Build Coastguard Worker 40*e4a36f41SAndroid Build Coastguard Worker# For formatting adoptable storage devices 41*e4a36f41SAndroid Build Coastguard Workerallow vold e2fs_exec:file rx_file_perms; 42*e4a36f41SAndroid Build Coastguard Worker 43*e4a36f41SAndroid Build Coastguard Worker# Run fstrim on mounted partitions 44*e4a36f41SAndroid Build Coastguard Worker# allowxperm still requires the ioctl permission for the individual type 45*e4a36f41SAndroid Build Coastguard Workerallowxperm vold { fs_type file_type }:dir ioctl FITRIM; 46*e4a36f41SAndroid Build Coastguard Worker 47*e4a36f41SAndroid Build Coastguard Worker# Get/set file-based encryption policies on dirs in /data and adoptable storage, 48*e4a36f41SAndroid Build Coastguard Worker# and add/remove file-based encryption keys. 49*e4a36f41SAndroid Build Coastguard Workerallowxperm vold data_file_type:dir ioctl { 50*e4a36f41SAndroid Build Coastguard Worker FS_IOC_GET_ENCRYPTION_POLICY 51*e4a36f41SAndroid Build Coastguard Worker FS_IOC_SET_ENCRYPTION_POLICY 52*e4a36f41SAndroid Build Coastguard Worker FS_IOC_ADD_ENCRYPTION_KEY 53*e4a36f41SAndroid Build Coastguard Worker FS_IOC_REMOVE_ENCRYPTION_KEY 54*e4a36f41SAndroid Build Coastguard Worker}; 55*e4a36f41SAndroid Build Coastguard Worker 56*e4a36f41SAndroid Build Coastguard Worker# Only vold and init should ever set file-based encryption policies. 57*e4a36f41SAndroid Build Coastguard Workerneverallowxperm { 58*e4a36f41SAndroid Build Coastguard Worker domain 59*e4a36f41SAndroid Build Coastguard Worker -vold 60*e4a36f41SAndroid Build Coastguard Worker -init 61*e4a36f41SAndroid Build Coastguard Worker -vendor_init 62*e4a36f41SAndroid Build Coastguard Worker} data_file_type:dir ioctl { FS_IOC_SET_ENCRYPTION_POLICY }; 63*e4a36f41SAndroid Build Coastguard Worker 64*e4a36f41SAndroid Build Coastguard Worker# Only vold should ever add/remove file-based encryption keys. 65*e4a36f41SAndroid Build Coastguard Workerneverallowxperm { 66*e4a36f41SAndroid Build Coastguard Worker domain 67*e4a36f41SAndroid Build Coastguard Worker -vold 68*e4a36f41SAndroid Build Coastguard Worker} data_file_type:dir ioctl { FS_IOC_ADD_ENCRYPTION_KEY FS_IOC_REMOVE_ENCRYPTION_KEY }; 69*e4a36f41SAndroid Build Coastguard Worker 70*e4a36f41SAndroid Build Coastguard Worker# Allow securely erasing crypto key files. F2FS_IOC_SEC_TRIM_FILE is 71*e4a36f41SAndroid Build Coastguard Worker# tried first. Otherwise, FS_IOC_FIEMAP is needed to get the 72*e4a36f41SAndroid Build Coastguard Worker# location of the file's blocks on the raw block device to erase. 73*e4a36f41SAndroid Build Coastguard Workerallowxperm vold { 74*e4a36f41SAndroid Build Coastguard Worker vold_data_file 75*e4a36f41SAndroid Build Coastguard Worker vold_metadata_file 76*e4a36f41SAndroid Build Coastguard Worker}:file ioctl { 77*e4a36f41SAndroid Build Coastguard Worker F2FS_IOC_SEC_TRIM_FILE 78*e4a36f41SAndroid Build Coastguard Worker FS_IOC_FIEMAP 79*e4a36f41SAndroid Build Coastguard Worker}; 80*e4a36f41SAndroid Build Coastguard Worker 81*e4a36f41SAndroid Build Coastguard Workertypeattribute vold mlstrustedsubject; 82*e4a36f41SAndroid Build Coastguard Workerallow vold self:process setfscreate; 83*e4a36f41SAndroid Build Coastguard Workerallow vold system_file:file x_file_perms; 84*e4a36f41SAndroid Build Coastguard Workernot_full_treble(`allow vold vendor_file:file x_file_perms;') 85*e4a36f41SAndroid Build Coastguard Workerallow vold block_device:dir create_dir_perms; 86*e4a36f41SAndroid Build Coastguard Workerallow vold device:dir write; 87*e4a36f41SAndroid Build Coastguard Workerallow vold devpts:chr_file rw_file_perms; 88*e4a36f41SAndroid Build Coastguard Workerallow vold rootfs:dir mounton; 89*e4a36f41SAndroid Build Coastguard Workerallow vold sdcard_type:dir mounton; # TODO: deprecated in M 90*e4a36f41SAndroid Build Coastguard Workerallow vold sdcard_type:filesystem { mount remount unmount }; # TODO: deprecated in M 91*e4a36f41SAndroid Build Coastguard Workerallow vold sdcard_type:dir create_dir_perms; # TODO: deprecated in M 92*e4a36f41SAndroid Build Coastguard Workerallow vold sdcard_type:file create_file_perms; # TODO: deprecated in M 93*e4a36f41SAndroid Build Coastguard Worker 94*e4a36f41SAndroid Build Coastguard Worker# Manage locations where storage is mounted 95*e4a36f41SAndroid Build Coastguard Workerallow vold { mnt_media_rw_file storage_file sdcard_type }:dir create_dir_perms; 96*e4a36f41SAndroid Build Coastguard Workerallow vold { mnt_media_rw_file storage_file sdcard_type }:file create_file_perms; 97*e4a36f41SAndroid Build Coastguard Worker 98*e4a36f41SAndroid Build Coastguard Worker# Access to storage that backs emulated FUSE daemons for migration optimization 99*e4a36f41SAndroid Build Coastguard Workerallow vold media_rw_data_file:dir create_dir_perms; 100*e4a36f41SAndroid Build Coastguard Workerallow vold media_rw_data_file:file create_file_perms; 101*e4a36f41SAndroid Build Coastguard Worker# Allow mounting (lower filesystem) on parts of media for performance 102*e4a36f41SAndroid Build Coastguard Workerallow vold media_rw_data_file:dir mounton; 103*e4a36f41SAndroid Build Coastguard Worker 104*e4a36f41SAndroid Build Coastguard Worker# Allow setting extended attributes (for project quota IDs) on files and dirs 105*e4a36f41SAndroid Build Coastguard Worker# and to enable project ID inheritance through FS_IOC_SETFLAGS 106*e4a36f41SAndroid Build Coastguard Workerallowxperm vold media_rw_data_file:{ dir file } ioctl { 107*e4a36f41SAndroid Build Coastguard Worker FS_IOC_FSGETXATTR 108*e4a36f41SAndroid Build Coastguard Worker FS_IOC_FSSETXATTR 109*e4a36f41SAndroid Build Coastguard Worker FS_IOC_GETFLAGS 110*e4a36f41SAndroid Build Coastguard Worker FS_IOC_SETFLAGS 111*e4a36f41SAndroid Build Coastguard Worker}; 112*e4a36f41SAndroid Build Coastguard Worker 113*e4a36f41SAndroid Build Coastguard Worker# Allow mounting of storage devices 114*e4a36f41SAndroid Build Coastguard Workerallow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr }; 115*e4a36f41SAndroid Build Coastguard Worker 116*e4a36f41SAndroid Build Coastguard Worker# Manage per-user primary symlinks 117*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_user_file:dir { create_dir_perms mounton }; 118*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_user_file:lnk_file create_file_perms; 119*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_user_file:file create_file_perms; 120*e4a36f41SAndroid Build Coastguard Worker 121*e4a36f41SAndroid Build Coastguard Worker# Manage per-user pass_through primary symlinks 122*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_pass_through_file:dir { create_dir_perms mounton }; 123*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_pass_through_file:lnk_file create_file_perms; 124*e4a36f41SAndroid Build Coastguard Worker 125*e4a36f41SAndroid Build Coastguard Worker# Allow to create and mount expanded storage 126*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_expand_file:dir { create_dir_perms mounton }; 127*e4a36f41SAndroid Build Coastguard Workerallow vold apk_data_file:dir { create getattr setattr }; 128*e4a36f41SAndroid Build Coastguard Workerallow vold shell_data_file:dir { create getattr setattr }; 129*e4a36f41SAndroid Build Coastguard Worker 130*e4a36f41SAndroid Build Coastguard Worker# Allow to mount incremental file system on /data/incremental and create files 131*e4a36f41SAndroid Build Coastguard Workerallow vold apk_data_file:dir { mounton rw_dir_perms }; 132*e4a36f41SAndroid Build Coastguard Worker# Allow to create and write files in /data/incremental 133*e4a36f41SAndroid Build Coastguard Workerallow vold apk_data_file:file { rw_file_perms unlink }; 134*e4a36f41SAndroid Build Coastguard Worker# Allow to bind-mount incremental file system on /data/app/vmdl*.tmp and read files 135*e4a36f41SAndroid Build Coastguard Workerallow vold apk_tmp_file:dir { mounton r_dir_perms }; 136*e4a36f41SAndroid Build Coastguard Worker# Allow to read incremental control file and call selinux restorecon on it 137*e4a36f41SAndroid Build Coastguard Workerallow vold incremental_control_file:file { r_file_perms relabelto }; 138*e4a36f41SAndroid Build Coastguard Worker 139*e4a36f41SAndroid Build Coastguard Workerallow vold tmpfs:filesystem { mount unmount }; 140*e4a36f41SAndroid Build Coastguard Workerallow vold tmpfs:dir create_dir_perms; 141*e4a36f41SAndroid Build Coastguard Workerallow vold tmpfs:dir mounton; 142*e4a36f41SAndroid Build Coastguard Workerallow vold self:global_capability_class_set { net_admin dac_override dac_read_search mknod sys_admin chown fowner fsetid }; 143*e4a36f41SAndroid Build Coastguard Workerallow vold self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; 144*e4a36f41SAndroid Build Coastguard Workerallow vold loop_control_device:chr_file rw_file_perms; 145*e4a36f41SAndroid Build Coastguard Workerallow vold loop_device:blk_file { create setattr unlink rw_file_perms }; 146*e4a36f41SAndroid Build Coastguard Workerallowxperm vold loop_device:blk_file ioctl { 147*e4a36f41SAndroid Build Coastguard Worker LOOP_CLR_FD 148*e4a36f41SAndroid Build Coastguard Worker LOOP_CTL_GET_FREE 149*e4a36f41SAndroid Build Coastguard Worker LOOP_GET_STATUS64 150*e4a36f41SAndroid Build Coastguard Worker LOOP_SET_FD 151*e4a36f41SAndroid Build Coastguard Worker LOOP_SET_STATUS64 152*e4a36f41SAndroid Build Coastguard Worker}; 153*e4a36f41SAndroid Build Coastguard Workerallow vold vold_device:blk_file { create setattr unlink rw_file_perms }; 154*e4a36f41SAndroid Build Coastguard Workerallowxperm vold vold_device:blk_file ioctl { BLKDISCARD BLKGETSIZE }; 155*e4a36f41SAndroid Build Coastguard Workerallow vold dm_device:chr_file rw_file_perms; 156*e4a36f41SAndroid Build Coastguard Workerallow vold dm_device:blk_file rw_file_perms; 157*e4a36f41SAndroid Build Coastguard Workerallowxperm vold dm_device:blk_file ioctl { BLKDISCARD BLKSECDISCARD }; 158*e4a36f41SAndroid Build Coastguard Worker# For vold Process::killProcessesWithOpenFiles function. 159*e4a36f41SAndroid Build Coastguard Workerallow vold domain:dir r_dir_perms; 160*e4a36f41SAndroid Build Coastguard Workerallow vold domain:{ file lnk_file } r_file_perms; 161*e4a36f41SAndroid Build Coastguard Workerallow vold domain:process { signal sigkill }; 162*e4a36f41SAndroid Build Coastguard Workerallow vold self:global_capability_class_set { sys_ptrace kill }; 163*e4a36f41SAndroid Build Coastguard Worker 164*e4a36f41SAndroid Build Coastguard Workerallow vold kmsg_device:chr_file rw_file_perms; 165*e4a36f41SAndroid Build Coastguard Worker 166*e4a36f41SAndroid Build Coastguard Worker# Run fsck in the fsck domain. 167*e4a36f41SAndroid Build Coastguard Workerallow vold fsck_exec:file { r_file_perms execute }; 168*e4a36f41SAndroid Build Coastguard Worker 169*e4a36f41SAndroid Build Coastguard Worker# Log fsck results 170*e4a36f41SAndroid Build Coastguard Workerallow vold fscklogs:dir rw_dir_perms; 171*e4a36f41SAndroid Build Coastguard Workerallow vold fscklogs:file create_file_perms; 172*e4a36f41SAndroid Build Coastguard Worker 173*e4a36f41SAndroid Build Coastguard Worker# 174*e4a36f41SAndroid Build Coastguard Worker# Rules to support encrypted fs support. 175*e4a36f41SAndroid Build Coastguard Worker# 176*e4a36f41SAndroid Build Coastguard Worker 177*e4a36f41SAndroid Build Coastguard Worker# Unmount and mount the fs. 178*e4a36f41SAndroid Build Coastguard Workerallow vold labeledfs:filesystem { mount unmount remount }; 179*e4a36f41SAndroid Build Coastguard Worker 180*e4a36f41SAndroid Build Coastguard Worker# Access /efs/userdata_footer. 181*e4a36f41SAndroid Build Coastguard Worker# XXX Split into a separate type? 182*e4a36f41SAndroid Build Coastguard Workerallow vold efs_file:file rw_file_perms; 183*e4a36f41SAndroid Build Coastguard Worker 184*e4a36f41SAndroid Build Coastguard Worker# Create and mount on /data/tmp_mnt and management of expansion mounts 185*e4a36f41SAndroid Build Coastguard Workerallow vold { 186*e4a36f41SAndroid Build Coastguard Worker system_data_file 187*e4a36f41SAndroid Build Coastguard Worker system_data_root_file 188*e4a36f41SAndroid Build Coastguard Worker}:dir { create rw_dir_perms mounton setattr rmdir }; 189*e4a36f41SAndroid Build Coastguard Workerallow vold system_data_file:lnk_file getattr; 190*e4a36f41SAndroid Build Coastguard Worker 191*e4a36f41SAndroid Build Coastguard Worker# Vold create users in /data/vendor_{ce,de}/[0-9]+ 192*e4a36f41SAndroid Build Coastguard Workerallow vold vendor_data_file:dir create_dir_perms; 193*e4a36f41SAndroid Build Coastguard Worker 194*e4a36f41SAndroid Build Coastguard Worker# for secdiscard 195*e4a36f41SAndroid Build Coastguard Workerallow vold system_data_file:file read; 196*e4a36f41SAndroid Build Coastguard Worker 197*e4a36f41SAndroid Build Coastguard Worker# Set scheduling policy of kernel processes 198*e4a36f41SAndroid Build Coastguard Workerallow vold kernel:process setsched; 199*e4a36f41SAndroid Build Coastguard Worker 200*e4a36f41SAndroid Build Coastguard Worker# ASEC 201*e4a36f41SAndroid Build Coastguard Workerallow vold asec_image_file:file create_file_perms; 202*e4a36f41SAndroid Build Coastguard Workerallow vold asec_image_file:dir rw_dir_perms; 203*e4a36f41SAndroid Build Coastguard Workerallow vold asec_apk_file:dir { create_dir_perms mounton relabelfrom relabelto }; 204*e4a36f41SAndroid Build Coastguard Workerallow vold asec_public_file:dir { relabelto setattr }; 205*e4a36f41SAndroid Build Coastguard Workerallow vold asec_apk_file:file { r_file_perms setattr relabelfrom relabelto }; 206*e4a36f41SAndroid Build Coastguard Workerallow vold asec_public_file:file { relabelto setattr }; 207*e4a36f41SAndroid Build Coastguard Worker# restorecon files in asec containers created on 4.2 or earlier. 208*e4a36f41SAndroid Build Coastguard Workerallow vold unlabeled:dir { r_dir_perms setattr relabelfrom }; 209*e4a36f41SAndroid Build Coastguard Workerallow vold unlabeled:file { r_file_perms setattr relabelfrom }; 210*e4a36f41SAndroid Build Coastguard Worker 211*e4a36f41SAndroid Build Coastguard Worker# Access to FUSE control filesystem to hard-abort FUSE mounts 212*e4a36f41SAndroid Build Coastguard Workerallow vold fusectlfs:file rw_file_perms; 213*e4a36f41SAndroid Build Coastguard Workerallow vold fusectlfs:dir rw_dir_perms; 214*e4a36f41SAndroid Build Coastguard Worker 215*e4a36f41SAndroid Build Coastguard Worker# Handle wake locks (used for device encryption) 216*e4a36f41SAndroid Build Coastguard Workerwakelock_use(vold) 217*e4a36f41SAndroid Build Coastguard Worker 218*e4a36f41SAndroid Build Coastguard Worker# Allow vold to publish a binder service and make binder calls. 219*e4a36f41SAndroid Build Coastguard Workerbinder_use(vold) 220*e4a36f41SAndroid Build Coastguard Workeradd_service(vold, vold_service) 221*e4a36f41SAndroid Build Coastguard Worker 222*e4a36f41SAndroid Build Coastguard Worker# Allow vold to call into the system server so it can check permissions. 223*e4a36f41SAndroid Build Coastguard Workerbinder_call(vold, system_server) 224*e4a36f41SAndroid Build Coastguard Workerallow vold permission_service:service_manager find; 225*e4a36f41SAndroid Build Coastguard Worker 226*e4a36f41SAndroid Build Coastguard Worker# talk to batteryservice 227*e4a36f41SAndroid Build Coastguard Workerbinder_call(vold, healthd) 228*e4a36f41SAndroid Build Coastguard Worker 229*e4a36f41SAndroid Build Coastguard Worker# talk to keymaster 230*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(vold, hal_keymaster) 231*e4a36f41SAndroid Build Coastguard Worker 232*e4a36f41SAndroid Build Coastguard Worker# talk to health storage HAL 233*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(vold, hal_health_storage) 234*e4a36f41SAndroid Build Coastguard Worker 235*e4a36f41SAndroid Build Coastguard Worker# talk to bootloader HAL 236*e4a36f41SAndroid Build Coastguard Workerfull_treble_only(`hal_client_domain(vold, hal_bootctl)') 237*e4a36f41SAndroid Build Coastguard Worker 238*e4a36f41SAndroid Build Coastguard Worker# Access userdata block device. 239*e4a36f41SAndroid Build Coastguard Workerallow vold userdata_block_device:blk_file rw_file_perms; 240*e4a36f41SAndroid Build Coastguard Workerallowxperm vold userdata_block_device:blk_file ioctl BLKSECDISCARD; 241*e4a36f41SAndroid Build Coastguard Worker 242*e4a36f41SAndroid Build Coastguard Worker# Access metadata block device used for encryption meta-data. 243*e4a36f41SAndroid Build Coastguard Workerallow vold metadata_block_device:blk_file rw_file_perms; 244*e4a36f41SAndroid Build Coastguard Workerallowxperm vold metadata_block_device:blk_file ioctl BLKSECDISCARD; 245*e4a36f41SAndroid Build Coastguard Worker 246*e4a36f41SAndroid Build Coastguard Worker# Allow vold to manipulate /data/unencrypted 247*e4a36f41SAndroid Build Coastguard Workerallow vold unencrypted_data_file:{ file } create_file_perms; 248*e4a36f41SAndroid Build Coastguard Workerallow vold unencrypted_data_file:dir create_dir_perms; 249*e4a36f41SAndroid Build Coastguard Worker 250*e4a36f41SAndroid Build Coastguard Worker# Write to /proc/sys/vm/drop_caches 251*e4a36f41SAndroid Build Coastguard Workerallow vold proc_drop_caches:file w_file_perms; 252*e4a36f41SAndroid Build Coastguard Worker 253*e4a36f41SAndroid Build Coastguard Worker# Give vold a place where only vold can store files; everyone else is off limits 254*e4a36f41SAndroid Build Coastguard Workerallow vold vold_data_file:dir create_dir_perms; 255*e4a36f41SAndroid Build Coastguard Workerallow vold vold_data_file:file create_file_perms; 256*e4a36f41SAndroid Build Coastguard Worker 257*e4a36f41SAndroid Build Coastguard Worker# And a similar place in the metadata partition 258*e4a36f41SAndroid Build Coastguard Workerallow vold vold_metadata_file:dir create_dir_perms; 259*e4a36f41SAndroid Build Coastguard Workerallow vold vold_metadata_file:file create_file_perms; 260*e4a36f41SAndroid Build Coastguard Worker 261*e4a36f41SAndroid Build Coastguard Worker# linux keyring configuration 262*e4a36f41SAndroid Build Coastguard Workerallow vold init:key { write search setattr }; 263*e4a36f41SAndroid Build Coastguard Workerallow vold vold:key { write search setattr }; 264*e4a36f41SAndroid Build Coastguard Worker 265*e4a36f41SAndroid Build Coastguard Worker# vold temporarily changes its priority when running benchmarks 266*e4a36f41SAndroid Build Coastguard Workerallow vold self:global_capability_class_set sys_nice; 267*e4a36f41SAndroid Build Coastguard Worker 268*e4a36f41SAndroid Build Coastguard Worker# vold needs to chroot into app namespaces to remount when runtime permissions change 269*e4a36f41SAndroid Build Coastguard Workerallow vold self:global_capability_class_set sys_chroot; 270*e4a36f41SAndroid Build Coastguard Workerallow vold storage_file:dir mounton; 271*e4a36f41SAndroid Build Coastguard Worker 272*e4a36f41SAndroid Build Coastguard Worker# For AppFuse. 273*e4a36f41SAndroid Build Coastguard Workerallow vold fuse_device:chr_file rw_file_perms; 274*e4a36f41SAndroid Build Coastguard Workerallow vold fuse:filesystem { relabelfrom }; 275*e4a36f41SAndroid Build Coastguard Workerallow vold app_fusefs:filesystem { relabelfrom relabelto }; 276*e4a36f41SAndroid Build Coastguard Workerallow vold app_fusefs:filesystem { mount unmount }; 277*e4a36f41SAndroid Build Coastguard Workerallow vold app_fuse_file:dir rw_dir_perms; 278*e4a36f41SAndroid Build Coastguard Workerallow vold app_fuse_file:file { read write open getattr append }; 279*e4a36f41SAndroid Build Coastguard Worker 280*e4a36f41SAndroid Build Coastguard Worker# MoveTask.cpp executes cp and rm 281*e4a36f41SAndroid Build Coastguard Workerallow vold toolbox_exec:file rx_file_perms; 282*e4a36f41SAndroid Build Coastguard Worker 283*e4a36f41SAndroid Build Coastguard Worker# Prepare profile dir for users. 284*e4a36f41SAndroid Build Coastguard Workerallow vold { user_profile_data_file user_profile_root_file }:dir create_dir_perms; 285*e4a36f41SAndroid Build Coastguard Worker 286*e4a36f41SAndroid Build Coastguard Worker# Raw writes to misc block device 287*e4a36f41SAndroid Build Coastguard Workerallow vold misc_block_device:blk_file w_file_perms; 288*e4a36f41SAndroid Build Coastguard Worker 289*e4a36f41SAndroid Build Coastguard Worker# vold might need to search or mount /mnt/vendor/* 290*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_vendor_file:dir search; 291*e4a36f41SAndroid Build Coastguard Worker 292*e4a36f41SAndroid Build Coastguard Workerdontaudit vold self:global_capability_class_set sys_resource; 293*e4a36f41SAndroid Build Coastguard Worker 294*e4a36f41SAndroid Build Coastguard Worker# Allow ReadDefaultFstab(). 295*e4a36f41SAndroid Build Coastguard Workerread_fstab(vold) 296*e4a36f41SAndroid Build Coastguard Worker 297*e4a36f41SAndroid Build Coastguard Worker# vold might need to search loopback apex files 298*e4a36f41SAndroid Build Coastguard Workerallow vold vendor_apex_file:file r_file_perms; 299*e4a36f41SAndroid Build Coastguard Worker 300*e4a36f41SAndroid Build Coastguard Workerneverallow { 301*e4a36f41SAndroid Build Coastguard Worker domain 302*e4a36f41SAndroid Build Coastguard Worker -vold 303*e4a36f41SAndroid Build Coastguard Worker -vold_prepare_subdirs 304*e4a36f41SAndroid Build Coastguard Worker} vold_data_file:dir ~{ open create read getattr setattr search relabelfrom relabelto ioctl }; 305*e4a36f41SAndroid Build Coastguard Worker 306*e4a36f41SAndroid Build Coastguard Workerneverallow { 307*e4a36f41SAndroid Build Coastguard Worker domain 308*e4a36f41SAndroid Build Coastguard Worker -init 309*e4a36f41SAndroid Build Coastguard Worker -vold 310*e4a36f41SAndroid Build Coastguard Worker -vold_prepare_subdirs 311*e4a36f41SAndroid Build Coastguard Worker} vold_data_file:dir *; 312*e4a36f41SAndroid Build Coastguard Worker 313*e4a36f41SAndroid Build Coastguard Workerneverallow { 314*e4a36f41SAndroid Build Coastguard Worker domain 315*e4a36f41SAndroid Build Coastguard Worker -init 316*e4a36f41SAndroid Build Coastguard Worker -vold 317*e4a36f41SAndroid Build Coastguard Worker} vold_metadata_file:dir *; 318*e4a36f41SAndroid Build Coastguard Worker 319*e4a36f41SAndroid Build Coastguard Workerneverallow { 320*e4a36f41SAndroid Build Coastguard Worker domain 321*e4a36f41SAndroid Build Coastguard Worker -kernel 322*e4a36f41SAndroid Build Coastguard Worker -vold 323*e4a36f41SAndroid Build Coastguard Worker -vold_prepare_subdirs 324*e4a36f41SAndroid Build Coastguard Worker} vold_data_file:notdevfile_class_set ~{ relabelto getattr }; 325*e4a36f41SAndroid Build Coastguard Worker 326*e4a36f41SAndroid Build Coastguard Workerneverallow { 327*e4a36f41SAndroid Build Coastguard Worker domain 328*e4a36f41SAndroid Build Coastguard Worker -init 329*e4a36f41SAndroid Build Coastguard Worker -vold 330*e4a36f41SAndroid Build Coastguard Worker -vold_prepare_subdirs 331*e4a36f41SAndroid Build Coastguard Worker} vold_metadata_file:notdevfile_class_set ~{ relabelto getattr }; 332*e4a36f41SAndroid Build Coastguard Worker 333*e4a36f41SAndroid Build Coastguard Workerneverallow { 334*e4a36f41SAndroid Build Coastguard Worker domain 335*e4a36f41SAndroid Build Coastguard Worker -init 336*e4a36f41SAndroid Build Coastguard Worker -kernel 337*e4a36f41SAndroid Build Coastguard Worker -vold 338*e4a36f41SAndroid Build Coastguard Worker -vold_prepare_subdirs 339*e4a36f41SAndroid Build Coastguard Worker} { vold_data_file vold_metadata_file }:notdevfile_class_set *; 340*e4a36f41SAndroid Build Coastguard Worker 341*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -vold -init } restorecon_prop:property_service set; 342*e4a36f41SAndroid Build Coastguard Worker 343*e4a36f41SAndroid Build Coastguard Workerneverallow vold { 344*e4a36f41SAndroid Build Coastguard Worker domain 345*e4a36f41SAndroid Build Coastguard Worker -hal_health_storage_server 346*e4a36f41SAndroid Build Coastguard Worker -hal_keymaster_server 347*e4a36f41SAndroid Build Coastguard Worker -system_suspend_server 348*e4a36f41SAndroid Build Coastguard Worker -hal_bootctl_server 349*e4a36f41SAndroid Build Coastguard Worker -healthd 350*e4a36f41SAndroid Build Coastguard Worker -hwservicemanager 351*e4a36f41SAndroid Build Coastguard Worker -iorapd_service 352*e4a36f41SAndroid Build Coastguard Worker -keystore 353*e4a36f41SAndroid Build Coastguard Worker -servicemanager 354*e4a36f41SAndroid Build Coastguard Worker -system_server 355*e4a36f41SAndroid Build Coastguard Worker userdebug_or_eng(`-su') 356*e4a36f41SAndroid Build Coastguard Worker}:binder call; 357*e4a36f41SAndroid Build Coastguard Worker 358*e4a36f41SAndroid Build Coastguard Workerneverallow vold fsck_exec:file execute_no_trans; 359*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -init } vold:process { transition dyntransition }; 360*e4a36f41SAndroid Build Coastguard Workerneverallow vold *:process ptrace; 361*e4a36f41SAndroid Build Coastguard Workerneverallow vold *:rawip_socket *; 362