xref: /aosp_15_r20/system/sepolicy/prebuilts/api/31.0/public/vold.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)
1*e4a36f41SAndroid Build Coastguard Worker# volume manager
2*e4a36f41SAndroid Build Coastguard Workertype vold, domain;
3*e4a36f41SAndroid Build Coastguard Workertype vold_exec, exec_type, file_type, system_file_type;
4*e4a36f41SAndroid Build Coastguard Worker
5*e4a36f41SAndroid Build Coastguard Worker# Read already opened /cache files.
6*e4a36f41SAndroid Build Coastguard Workerallow vold cache_file:dir r_dir_perms;
7*e4a36f41SAndroid Build Coastguard Workerallow vold cache_file:file { getattr read };
8*e4a36f41SAndroid Build Coastguard Workerallow vold cache_file:lnk_file r_file_perms;
9*e4a36f41SAndroid Build Coastguard Worker
10*e4a36f41SAndroid Build Coastguard Workerr_dir_file(vold, { sysfs_type -sysfs_batteryinfo })
11*e4a36f41SAndroid Build Coastguard Worker# XXX Label sysfs files with a specific type?
12*e4a36f41SAndroid Build Coastguard Workerallow vold {
13*e4a36f41SAndroid Build Coastguard Worker  sysfs # writing to /sys/*/uevent during coldboot.
14*e4a36f41SAndroid Build Coastguard Worker  sysfs_devices_block
15*e4a36f41SAndroid Build Coastguard Worker  sysfs_dm
16*e4a36f41SAndroid Build Coastguard Worker  sysfs_loop # writing to /sys/block/loop*/uevent during coldboot.
17*e4a36f41SAndroid Build Coastguard Worker  sysfs_usb
18*e4a36f41SAndroid Build Coastguard Worker  sysfs_zram_uevent
19*e4a36f41SAndroid Build Coastguard Worker  sysfs_fs_f2fs
20*e4a36f41SAndroid Build Coastguard Worker}:file w_file_perms;
21*e4a36f41SAndroid Build Coastguard Worker
22*e4a36f41SAndroid Build Coastguard Workerr_dir_file(vold, rootfs)
23*e4a36f41SAndroid Build Coastguard Workerr_dir_file(vold, metadata_file)
24*e4a36f41SAndroid Build Coastguard Workerallow vold {
25*e4a36f41SAndroid Build Coastguard Worker  proc # b/67049235 processes /proc/<pid>/* files are mislabeled.
26*e4a36f41SAndroid Build Coastguard Worker  proc_bootconfig
27*e4a36f41SAndroid Build Coastguard Worker  proc_cmdline
28*e4a36f41SAndroid Build Coastguard Worker  proc_drop_caches
29*e4a36f41SAndroid Build Coastguard Worker  proc_filesystems
30*e4a36f41SAndroid Build Coastguard Worker  proc_meminfo
31*e4a36f41SAndroid Build Coastguard Worker  proc_mounts
32*e4a36f41SAndroid Build Coastguard Worker}:file r_file_perms;
33*e4a36f41SAndroid Build Coastguard Worker
34*e4a36f41SAndroid Build Coastguard Worker#Get file contexts
35*e4a36f41SAndroid Build Coastguard Workerallow vold file_contexts_file:file r_file_perms;
36*e4a36f41SAndroid Build Coastguard Worker
37*e4a36f41SAndroid Build Coastguard Worker# Allow us to jump into execution domains of above tools
38*e4a36f41SAndroid Build Coastguard Workerallow vold self:process setexec;
39*e4a36f41SAndroid Build Coastguard Worker
40*e4a36f41SAndroid Build Coastguard Worker# For formatting adoptable storage devices
41*e4a36f41SAndroid Build Coastguard Workerallow vold e2fs_exec:file rx_file_perms;
42*e4a36f41SAndroid Build Coastguard Worker
43*e4a36f41SAndroid Build Coastguard Worker# Run fstrim on mounted partitions
44*e4a36f41SAndroid Build Coastguard Worker# allowxperm still requires the ioctl permission for the individual type
45*e4a36f41SAndroid Build Coastguard Workerallowxperm vold { fs_type file_type }:dir ioctl FITRIM;
46*e4a36f41SAndroid Build Coastguard Worker
47*e4a36f41SAndroid Build Coastguard Worker# Get/set file-based encryption policies on dirs in /data and adoptable storage,
48*e4a36f41SAndroid Build Coastguard Worker# and add/remove file-based encryption keys.
49*e4a36f41SAndroid Build Coastguard Workerallowxperm vold data_file_type:dir ioctl {
50*e4a36f41SAndroid Build Coastguard Worker  FS_IOC_GET_ENCRYPTION_POLICY
51*e4a36f41SAndroid Build Coastguard Worker  FS_IOC_SET_ENCRYPTION_POLICY
52*e4a36f41SAndroid Build Coastguard Worker  FS_IOC_ADD_ENCRYPTION_KEY
53*e4a36f41SAndroid Build Coastguard Worker  FS_IOC_REMOVE_ENCRYPTION_KEY
54*e4a36f41SAndroid Build Coastguard Worker};
55*e4a36f41SAndroid Build Coastguard Worker
56*e4a36f41SAndroid Build Coastguard Worker# Only vold and init should ever set file-based encryption policies.
57*e4a36f41SAndroid Build Coastguard Workerneverallowxperm {
58*e4a36f41SAndroid Build Coastguard Worker  domain
59*e4a36f41SAndroid Build Coastguard Worker  -vold
60*e4a36f41SAndroid Build Coastguard Worker  -init
61*e4a36f41SAndroid Build Coastguard Worker  -vendor_init
62*e4a36f41SAndroid Build Coastguard Worker} data_file_type:dir ioctl { FS_IOC_SET_ENCRYPTION_POLICY };
63*e4a36f41SAndroid Build Coastguard Worker
64*e4a36f41SAndroid Build Coastguard Worker# Only vold should ever add/remove file-based encryption keys.
65*e4a36f41SAndroid Build Coastguard Workerneverallowxperm {
66*e4a36f41SAndroid Build Coastguard Worker  domain
67*e4a36f41SAndroid Build Coastguard Worker  -vold
68*e4a36f41SAndroid Build Coastguard Worker} data_file_type:dir ioctl { FS_IOC_ADD_ENCRYPTION_KEY FS_IOC_REMOVE_ENCRYPTION_KEY };
69*e4a36f41SAndroid Build Coastguard Worker
70*e4a36f41SAndroid Build Coastguard Worker# Allow securely erasing crypto key files. F2FS_IOC_SEC_TRIM_FILE is
71*e4a36f41SAndroid Build Coastguard Worker# tried first. Otherwise, FS_IOC_FIEMAP is needed to get the
72*e4a36f41SAndroid Build Coastguard Worker# location of the file's blocks on the raw block device to erase.
73*e4a36f41SAndroid Build Coastguard Workerallowxperm vold {
74*e4a36f41SAndroid Build Coastguard Worker  vold_data_file
75*e4a36f41SAndroid Build Coastguard Worker  vold_metadata_file
76*e4a36f41SAndroid Build Coastguard Worker}:file ioctl {
77*e4a36f41SAndroid Build Coastguard Worker  F2FS_IOC_SEC_TRIM_FILE
78*e4a36f41SAndroid Build Coastguard Worker  FS_IOC_FIEMAP
79*e4a36f41SAndroid Build Coastguard Worker};
80*e4a36f41SAndroid Build Coastguard Worker
81*e4a36f41SAndroid Build Coastguard Workertypeattribute vold mlstrustedsubject;
82*e4a36f41SAndroid Build Coastguard Workerallow vold self:process setfscreate;
83*e4a36f41SAndroid Build Coastguard Workerallow vold system_file:file x_file_perms;
84*e4a36f41SAndroid Build Coastguard Workernot_full_treble(`allow vold vendor_file:file x_file_perms;')
85*e4a36f41SAndroid Build Coastguard Workerallow vold block_device:dir create_dir_perms;
86*e4a36f41SAndroid Build Coastguard Workerallow vold device:dir write;
87*e4a36f41SAndroid Build Coastguard Workerallow vold devpts:chr_file rw_file_perms;
88*e4a36f41SAndroid Build Coastguard Workerallow vold rootfs:dir mounton;
89*e4a36f41SAndroid Build Coastguard Workerallow vold sdcard_type:dir mounton; # TODO: deprecated in M
90*e4a36f41SAndroid Build Coastguard Workerallow vold sdcard_type:filesystem { mount remount unmount }; # TODO: deprecated in M
91*e4a36f41SAndroid Build Coastguard Workerallow vold sdcard_type:dir create_dir_perms; # TODO: deprecated in M
92*e4a36f41SAndroid Build Coastguard Workerallow vold sdcard_type:file create_file_perms; # TODO: deprecated in M
93*e4a36f41SAndroid Build Coastguard Worker
94*e4a36f41SAndroid Build Coastguard Worker# Manage locations where storage is mounted
95*e4a36f41SAndroid Build Coastguard Workerallow vold { mnt_media_rw_file storage_file sdcard_type }:dir create_dir_perms;
96*e4a36f41SAndroid Build Coastguard Workerallow vold { mnt_media_rw_file storage_file sdcard_type }:file create_file_perms;
97*e4a36f41SAndroid Build Coastguard Worker
98*e4a36f41SAndroid Build Coastguard Worker# Access to storage that backs emulated FUSE daemons for migration optimization
99*e4a36f41SAndroid Build Coastguard Workerallow vold media_rw_data_file:dir create_dir_perms;
100*e4a36f41SAndroid Build Coastguard Workerallow vold media_rw_data_file:file create_file_perms;
101*e4a36f41SAndroid Build Coastguard Worker# Allow mounting (lower filesystem) on parts of media for performance
102*e4a36f41SAndroid Build Coastguard Workerallow vold media_rw_data_file:dir mounton;
103*e4a36f41SAndroid Build Coastguard Worker
104*e4a36f41SAndroid Build Coastguard Worker# Allow setting extended attributes (for project quota IDs) on files and dirs
105*e4a36f41SAndroid Build Coastguard Worker# and to enable project ID inheritance through FS_IOC_SETFLAGS
106*e4a36f41SAndroid Build Coastguard Workerallowxperm vold media_rw_data_file:{ dir file } ioctl {
107*e4a36f41SAndroid Build Coastguard Worker  FS_IOC_FSGETXATTR
108*e4a36f41SAndroid Build Coastguard Worker  FS_IOC_FSSETXATTR
109*e4a36f41SAndroid Build Coastguard Worker  FS_IOC_GETFLAGS
110*e4a36f41SAndroid Build Coastguard Worker  FS_IOC_SETFLAGS
111*e4a36f41SAndroid Build Coastguard Worker};
112*e4a36f41SAndroid Build Coastguard Worker
113*e4a36f41SAndroid Build Coastguard Worker# Allow mounting of storage devices
114*e4a36f41SAndroid Build Coastguard Workerallow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr };
115*e4a36f41SAndroid Build Coastguard Worker
116*e4a36f41SAndroid Build Coastguard Worker# Manage per-user primary symlinks
117*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_user_file:dir { create_dir_perms mounton };
118*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_user_file:lnk_file create_file_perms;
119*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_user_file:file create_file_perms;
120*e4a36f41SAndroid Build Coastguard Worker
121*e4a36f41SAndroid Build Coastguard Worker# Manage per-user pass_through primary symlinks
122*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_pass_through_file:dir { create_dir_perms mounton };
123*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_pass_through_file:lnk_file create_file_perms;
124*e4a36f41SAndroid Build Coastguard Worker
125*e4a36f41SAndroid Build Coastguard Worker# Allow to create and mount expanded storage
126*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_expand_file:dir { create_dir_perms mounton };
127*e4a36f41SAndroid Build Coastguard Workerallow vold apk_data_file:dir { create getattr setattr };
128*e4a36f41SAndroid Build Coastguard Workerallow vold shell_data_file:dir { create getattr setattr };
129*e4a36f41SAndroid Build Coastguard Worker
130*e4a36f41SAndroid Build Coastguard Worker# Allow to mount incremental file system on /data/incremental and create files
131*e4a36f41SAndroid Build Coastguard Workerallow vold apk_data_file:dir { mounton rw_dir_perms };
132*e4a36f41SAndroid Build Coastguard Worker# Allow to create and write files in /data/incremental
133*e4a36f41SAndroid Build Coastguard Workerallow vold apk_data_file:file { rw_file_perms unlink };
134*e4a36f41SAndroid Build Coastguard Worker# Allow to bind-mount incremental file system on /data/app/vmdl*.tmp and read files
135*e4a36f41SAndroid Build Coastguard Workerallow vold apk_tmp_file:dir { mounton r_dir_perms };
136*e4a36f41SAndroid Build Coastguard Worker# Allow to read incremental control file and call selinux restorecon on it
137*e4a36f41SAndroid Build Coastguard Workerallow vold incremental_control_file:file { r_file_perms relabelto };
138*e4a36f41SAndroid Build Coastguard Worker
139*e4a36f41SAndroid Build Coastguard Workerallow vold tmpfs:filesystem { mount unmount };
140*e4a36f41SAndroid Build Coastguard Workerallow vold tmpfs:dir create_dir_perms;
141*e4a36f41SAndroid Build Coastguard Workerallow vold tmpfs:dir mounton;
142*e4a36f41SAndroid Build Coastguard Workerallow vold self:global_capability_class_set { net_admin dac_override dac_read_search mknod sys_admin chown fowner fsetid };
143*e4a36f41SAndroid Build Coastguard Workerallow vold self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
144*e4a36f41SAndroid Build Coastguard Workerallow vold loop_control_device:chr_file rw_file_perms;
145*e4a36f41SAndroid Build Coastguard Workerallow vold loop_device:blk_file { create setattr unlink rw_file_perms };
146*e4a36f41SAndroid Build Coastguard Workerallowxperm vold loop_device:blk_file ioctl {
147*e4a36f41SAndroid Build Coastguard Worker  LOOP_CLR_FD
148*e4a36f41SAndroid Build Coastguard Worker  LOOP_CTL_GET_FREE
149*e4a36f41SAndroid Build Coastguard Worker  LOOP_GET_STATUS64
150*e4a36f41SAndroid Build Coastguard Worker  LOOP_SET_FD
151*e4a36f41SAndroid Build Coastguard Worker  LOOP_SET_STATUS64
152*e4a36f41SAndroid Build Coastguard Worker};
153*e4a36f41SAndroid Build Coastguard Workerallow vold vold_device:blk_file { create setattr unlink rw_file_perms };
154*e4a36f41SAndroid Build Coastguard Workerallowxperm vold vold_device:blk_file ioctl { BLKDISCARD BLKGETSIZE };
155*e4a36f41SAndroid Build Coastguard Workerallow vold dm_device:chr_file rw_file_perms;
156*e4a36f41SAndroid Build Coastguard Workerallow vold dm_device:blk_file rw_file_perms;
157*e4a36f41SAndroid Build Coastguard Workerallowxperm vold dm_device:blk_file ioctl { BLKDISCARD BLKSECDISCARD };
158*e4a36f41SAndroid Build Coastguard Worker# For vold Process::killProcessesWithOpenFiles function.
159*e4a36f41SAndroid Build Coastguard Workerallow vold domain:dir r_dir_perms;
160*e4a36f41SAndroid Build Coastguard Workerallow vold domain:{ file lnk_file } r_file_perms;
161*e4a36f41SAndroid Build Coastguard Workerallow vold domain:process { signal sigkill };
162*e4a36f41SAndroid Build Coastguard Workerallow vold self:global_capability_class_set { sys_ptrace kill };
163*e4a36f41SAndroid Build Coastguard Worker
164*e4a36f41SAndroid Build Coastguard Workerallow vold kmsg_device:chr_file rw_file_perms;
165*e4a36f41SAndroid Build Coastguard Worker
166*e4a36f41SAndroid Build Coastguard Worker# Run fsck in the fsck domain.
167*e4a36f41SAndroid Build Coastguard Workerallow vold fsck_exec:file { r_file_perms execute };
168*e4a36f41SAndroid Build Coastguard Worker
169*e4a36f41SAndroid Build Coastguard Worker# Log fsck results
170*e4a36f41SAndroid Build Coastguard Workerallow vold fscklogs:dir rw_dir_perms;
171*e4a36f41SAndroid Build Coastguard Workerallow vold fscklogs:file create_file_perms;
172*e4a36f41SAndroid Build Coastguard Worker
173*e4a36f41SAndroid Build Coastguard Worker#
174*e4a36f41SAndroid Build Coastguard Worker# Rules to support encrypted fs support.
175*e4a36f41SAndroid Build Coastguard Worker#
176*e4a36f41SAndroid Build Coastguard Worker
177*e4a36f41SAndroid Build Coastguard Worker# Unmount and mount the fs.
178*e4a36f41SAndroid Build Coastguard Workerallow vold labeledfs:filesystem { mount unmount remount };
179*e4a36f41SAndroid Build Coastguard Worker
180*e4a36f41SAndroid Build Coastguard Worker# Access /efs/userdata_footer.
181*e4a36f41SAndroid Build Coastguard Worker# XXX Split into a separate type?
182*e4a36f41SAndroid Build Coastguard Workerallow vold efs_file:file rw_file_perms;
183*e4a36f41SAndroid Build Coastguard Worker
184*e4a36f41SAndroid Build Coastguard Worker# Create and mount on /data/tmp_mnt and management of expansion mounts
185*e4a36f41SAndroid Build Coastguard Workerallow vold {
186*e4a36f41SAndroid Build Coastguard Worker    system_data_file
187*e4a36f41SAndroid Build Coastguard Worker    system_data_root_file
188*e4a36f41SAndroid Build Coastguard Worker}:dir { create rw_dir_perms mounton setattr rmdir };
189*e4a36f41SAndroid Build Coastguard Workerallow vold system_data_file:lnk_file getattr;
190*e4a36f41SAndroid Build Coastguard Worker
191*e4a36f41SAndroid Build Coastguard Worker# Vold create users in /data/vendor_{ce,de}/[0-9]+
192*e4a36f41SAndroid Build Coastguard Workerallow vold vendor_data_file:dir create_dir_perms;
193*e4a36f41SAndroid Build Coastguard Worker
194*e4a36f41SAndroid Build Coastguard Worker# for secdiscard
195*e4a36f41SAndroid Build Coastguard Workerallow vold system_data_file:file read;
196*e4a36f41SAndroid Build Coastguard Worker
197*e4a36f41SAndroid Build Coastguard Worker# Set scheduling policy of kernel processes
198*e4a36f41SAndroid Build Coastguard Workerallow vold kernel:process setsched;
199*e4a36f41SAndroid Build Coastguard Worker
200*e4a36f41SAndroid Build Coastguard Worker# ASEC
201*e4a36f41SAndroid Build Coastguard Workerallow vold asec_image_file:file create_file_perms;
202*e4a36f41SAndroid Build Coastguard Workerallow vold asec_image_file:dir rw_dir_perms;
203*e4a36f41SAndroid Build Coastguard Workerallow vold asec_apk_file:dir { create_dir_perms mounton relabelfrom relabelto };
204*e4a36f41SAndroid Build Coastguard Workerallow vold asec_public_file:dir { relabelto setattr };
205*e4a36f41SAndroid Build Coastguard Workerallow vold asec_apk_file:file { r_file_perms setattr relabelfrom relabelto };
206*e4a36f41SAndroid Build Coastguard Workerallow vold asec_public_file:file { relabelto setattr };
207*e4a36f41SAndroid Build Coastguard Worker# restorecon files in asec containers created on 4.2 or earlier.
208*e4a36f41SAndroid Build Coastguard Workerallow vold unlabeled:dir { r_dir_perms setattr relabelfrom };
209*e4a36f41SAndroid Build Coastguard Workerallow vold unlabeled:file { r_file_perms setattr relabelfrom };
210*e4a36f41SAndroid Build Coastguard Worker
211*e4a36f41SAndroid Build Coastguard Worker# Access to FUSE control filesystem to hard-abort FUSE mounts
212*e4a36f41SAndroid Build Coastguard Workerallow vold fusectlfs:file rw_file_perms;
213*e4a36f41SAndroid Build Coastguard Workerallow vold fusectlfs:dir rw_dir_perms;
214*e4a36f41SAndroid Build Coastguard Worker
215*e4a36f41SAndroid Build Coastguard Worker# Handle wake locks (used for device encryption)
216*e4a36f41SAndroid Build Coastguard Workerwakelock_use(vold)
217*e4a36f41SAndroid Build Coastguard Worker
218*e4a36f41SAndroid Build Coastguard Worker# Allow vold to publish a binder service and make binder calls.
219*e4a36f41SAndroid Build Coastguard Workerbinder_use(vold)
220*e4a36f41SAndroid Build Coastguard Workeradd_service(vold, vold_service)
221*e4a36f41SAndroid Build Coastguard Worker
222*e4a36f41SAndroid Build Coastguard Worker# Allow vold to call into the system server so it can check permissions.
223*e4a36f41SAndroid Build Coastguard Workerbinder_call(vold, system_server)
224*e4a36f41SAndroid Build Coastguard Workerallow vold permission_service:service_manager find;
225*e4a36f41SAndroid Build Coastguard Worker
226*e4a36f41SAndroid Build Coastguard Worker# talk to batteryservice
227*e4a36f41SAndroid Build Coastguard Workerbinder_call(vold, healthd)
228*e4a36f41SAndroid Build Coastguard Worker
229*e4a36f41SAndroid Build Coastguard Worker# talk to keymaster
230*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(vold, hal_keymaster)
231*e4a36f41SAndroid Build Coastguard Worker
232*e4a36f41SAndroid Build Coastguard Worker# talk to health storage HAL
233*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(vold, hal_health_storage)
234*e4a36f41SAndroid Build Coastguard Worker
235*e4a36f41SAndroid Build Coastguard Worker# talk to bootloader HAL
236*e4a36f41SAndroid Build Coastguard Workerfull_treble_only(`hal_client_domain(vold, hal_bootctl)')
237*e4a36f41SAndroid Build Coastguard Worker
238*e4a36f41SAndroid Build Coastguard Worker# Access userdata block device.
239*e4a36f41SAndroid Build Coastguard Workerallow vold userdata_block_device:blk_file rw_file_perms;
240*e4a36f41SAndroid Build Coastguard Workerallowxperm vold userdata_block_device:blk_file ioctl BLKSECDISCARD;
241*e4a36f41SAndroid Build Coastguard Worker
242*e4a36f41SAndroid Build Coastguard Worker# Access metadata block device used for encryption meta-data.
243*e4a36f41SAndroid Build Coastguard Workerallow vold metadata_block_device:blk_file rw_file_perms;
244*e4a36f41SAndroid Build Coastguard Workerallowxperm vold metadata_block_device:blk_file ioctl BLKSECDISCARD;
245*e4a36f41SAndroid Build Coastguard Worker
246*e4a36f41SAndroid Build Coastguard Worker# Allow vold to manipulate /data/unencrypted
247*e4a36f41SAndroid Build Coastguard Workerallow vold unencrypted_data_file:{ file } create_file_perms;
248*e4a36f41SAndroid Build Coastguard Workerallow vold unencrypted_data_file:dir create_dir_perms;
249*e4a36f41SAndroid Build Coastguard Worker
250*e4a36f41SAndroid Build Coastguard Worker# Write to /proc/sys/vm/drop_caches
251*e4a36f41SAndroid Build Coastguard Workerallow vold proc_drop_caches:file w_file_perms;
252*e4a36f41SAndroid Build Coastguard Worker
253*e4a36f41SAndroid Build Coastguard Worker# Give vold a place where only vold can store files; everyone else is off limits
254*e4a36f41SAndroid Build Coastguard Workerallow vold vold_data_file:dir create_dir_perms;
255*e4a36f41SAndroid Build Coastguard Workerallow vold vold_data_file:file create_file_perms;
256*e4a36f41SAndroid Build Coastguard Worker
257*e4a36f41SAndroid Build Coastguard Worker# And a similar place in the metadata partition
258*e4a36f41SAndroid Build Coastguard Workerallow vold vold_metadata_file:dir create_dir_perms;
259*e4a36f41SAndroid Build Coastguard Workerallow vold vold_metadata_file:file create_file_perms;
260*e4a36f41SAndroid Build Coastguard Worker
261*e4a36f41SAndroid Build Coastguard Worker# linux keyring configuration
262*e4a36f41SAndroid Build Coastguard Workerallow vold init:key { write search setattr };
263*e4a36f41SAndroid Build Coastguard Workerallow vold vold:key { write search setattr };
264*e4a36f41SAndroid Build Coastguard Worker
265*e4a36f41SAndroid Build Coastguard Worker# vold temporarily changes its priority when running benchmarks
266*e4a36f41SAndroid Build Coastguard Workerallow vold self:global_capability_class_set sys_nice;
267*e4a36f41SAndroid Build Coastguard Worker
268*e4a36f41SAndroid Build Coastguard Worker# vold needs to chroot into app namespaces to remount when runtime permissions change
269*e4a36f41SAndroid Build Coastguard Workerallow vold self:global_capability_class_set sys_chroot;
270*e4a36f41SAndroid Build Coastguard Workerallow vold storage_file:dir mounton;
271*e4a36f41SAndroid Build Coastguard Worker
272*e4a36f41SAndroid Build Coastguard Worker# For AppFuse.
273*e4a36f41SAndroid Build Coastguard Workerallow vold fuse_device:chr_file rw_file_perms;
274*e4a36f41SAndroid Build Coastguard Workerallow vold fuse:filesystem { relabelfrom };
275*e4a36f41SAndroid Build Coastguard Workerallow vold app_fusefs:filesystem { relabelfrom relabelto };
276*e4a36f41SAndroid Build Coastguard Workerallow vold app_fusefs:filesystem { mount unmount };
277*e4a36f41SAndroid Build Coastguard Workerallow vold app_fuse_file:dir rw_dir_perms;
278*e4a36f41SAndroid Build Coastguard Workerallow vold app_fuse_file:file { read write open getattr append };
279*e4a36f41SAndroid Build Coastguard Worker
280*e4a36f41SAndroid Build Coastguard Worker# MoveTask.cpp executes cp and rm
281*e4a36f41SAndroid Build Coastguard Workerallow vold toolbox_exec:file rx_file_perms;
282*e4a36f41SAndroid Build Coastguard Worker
283*e4a36f41SAndroid Build Coastguard Worker# Prepare profile dir for users.
284*e4a36f41SAndroid Build Coastguard Workerallow vold { user_profile_data_file user_profile_root_file }:dir create_dir_perms;
285*e4a36f41SAndroid Build Coastguard Worker
286*e4a36f41SAndroid Build Coastguard Worker# Raw writes to misc block device
287*e4a36f41SAndroid Build Coastguard Workerallow vold misc_block_device:blk_file w_file_perms;
288*e4a36f41SAndroid Build Coastguard Worker
289*e4a36f41SAndroid Build Coastguard Worker# vold might need to search or mount /mnt/vendor/*
290*e4a36f41SAndroid Build Coastguard Workerallow vold mnt_vendor_file:dir search;
291*e4a36f41SAndroid Build Coastguard Worker
292*e4a36f41SAndroid Build Coastguard Workerdontaudit vold self:global_capability_class_set sys_resource;
293*e4a36f41SAndroid Build Coastguard Worker
294*e4a36f41SAndroid Build Coastguard Worker# Allow ReadDefaultFstab().
295*e4a36f41SAndroid Build Coastguard Workerread_fstab(vold)
296*e4a36f41SAndroid Build Coastguard Worker
297*e4a36f41SAndroid Build Coastguard Worker# vold might need to search loopback apex files
298*e4a36f41SAndroid Build Coastguard Workerallow vold vendor_apex_file:file r_file_perms;
299*e4a36f41SAndroid Build Coastguard Worker
300*e4a36f41SAndroid Build Coastguard Workerneverallow {
301*e4a36f41SAndroid Build Coastguard Worker    domain
302*e4a36f41SAndroid Build Coastguard Worker    -vold
303*e4a36f41SAndroid Build Coastguard Worker    -vold_prepare_subdirs
304*e4a36f41SAndroid Build Coastguard Worker} vold_data_file:dir ~{ open create read getattr setattr search relabelfrom relabelto ioctl };
305*e4a36f41SAndroid Build Coastguard Worker
306*e4a36f41SAndroid Build Coastguard Workerneverallow {
307*e4a36f41SAndroid Build Coastguard Worker    domain
308*e4a36f41SAndroid Build Coastguard Worker    -init
309*e4a36f41SAndroid Build Coastguard Worker    -vold
310*e4a36f41SAndroid Build Coastguard Worker    -vold_prepare_subdirs
311*e4a36f41SAndroid Build Coastguard Worker} vold_data_file:dir *;
312*e4a36f41SAndroid Build Coastguard Worker
313*e4a36f41SAndroid Build Coastguard Workerneverallow {
314*e4a36f41SAndroid Build Coastguard Worker    domain
315*e4a36f41SAndroid Build Coastguard Worker    -init
316*e4a36f41SAndroid Build Coastguard Worker    -vold
317*e4a36f41SAndroid Build Coastguard Worker} vold_metadata_file:dir *;
318*e4a36f41SAndroid Build Coastguard Worker
319*e4a36f41SAndroid Build Coastguard Workerneverallow {
320*e4a36f41SAndroid Build Coastguard Worker    domain
321*e4a36f41SAndroid Build Coastguard Worker    -kernel
322*e4a36f41SAndroid Build Coastguard Worker    -vold
323*e4a36f41SAndroid Build Coastguard Worker    -vold_prepare_subdirs
324*e4a36f41SAndroid Build Coastguard Worker} vold_data_file:notdevfile_class_set ~{ relabelto getattr };
325*e4a36f41SAndroid Build Coastguard Worker
326*e4a36f41SAndroid Build Coastguard Workerneverallow {
327*e4a36f41SAndroid Build Coastguard Worker    domain
328*e4a36f41SAndroid Build Coastguard Worker    -init
329*e4a36f41SAndroid Build Coastguard Worker    -vold
330*e4a36f41SAndroid Build Coastguard Worker    -vold_prepare_subdirs
331*e4a36f41SAndroid Build Coastguard Worker} vold_metadata_file:notdevfile_class_set ~{ relabelto getattr };
332*e4a36f41SAndroid Build Coastguard Worker
333*e4a36f41SAndroid Build Coastguard Workerneverallow {
334*e4a36f41SAndroid Build Coastguard Worker    domain
335*e4a36f41SAndroid Build Coastguard Worker    -init
336*e4a36f41SAndroid Build Coastguard Worker    -kernel
337*e4a36f41SAndroid Build Coastguard Worker    -vold
338*e4a36f41SAndroid Build Coastguard Worker    -vold_prepare_subdirs
339*e4a36f41SAndroid Build Coastguard Worker} { vold_data_file vold_metadata_file }:notdevfile_class_set *;
340*e4a36f41SAndroid Build Coastguard Worker
341*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -vold -init } restorecon_prop:property_service set;
342*e4a36f41SAndroid Build Coastguard Worker
343*e4a36f41SAndroid Build Coastguard Workerneverallow vold {
344*e4a36f41SAndroid Build Coastguard Worker  domain
345*e4a36f41SAndroid Build Coastguard Worker  -hal_health_storage_server
346*e4a36f41SAndroid Build Coastguard Worker  -hal_keymaster_server
347*e4a36f41SAndroid Build Coastguard Worker  -system_suspend_server
348*e4a36f41SAndroid Build Coastguard Worker  -hal_bootctl_server
349*e4a36f41SAndroid Build Coastguard Worker  -healthd
350*e4a36f41SAndroid Build Coastguard Worker  -hwservicemanager
351*e4a36f41SAndroid Build Coastguard Worker  -iorapd_service
352*e4a36f41SAndroid Build Coastguard Worker  -keystore
353*e4a36f41SAndroid Build Coastguard Worker  -servicemanager
354*e4a36f41SAndroid Build Coastguard Worker  -system_server
355*e4a36f41SAndroid Build Coastguard Worker  userdebug_or_eng(`-su')
356*e4a36f41SAndroid Build Coastguard Worker}:binder call;
357*e4a36f41SAndroid Build Coastguard Worker
358*e4a36f41SAndroid Build Coastguard Workerneverallow vold fsck_exec:file execute_no_trans;
359*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -init } vold:process { transition dyntransition };
360*e4a36f41SAndroid Build Coastguard Workerneverallow vold *:process ptrace;
361*e4a36f41SAndroid Build Coastguard Workerneverallow vold *:rawip_socket *;
362