1typeattribute toolbox coredomain; 2 3init_daemon_domain(toolbox) 4 5# rm -rf in /data/misc/virtualizationservice 6allow toolbox virtualizationservice_data_file:dir { rmdir rw_dir_perms }; 7allow toolbox virtualizationservice_data_file:file { getattr unlink }; 8 9# If we can't remove these directories we try to chmod them. That 10# doesn't work, but it doesn't matter as virtualizationservice itself 11# will delete them when it starts. See b/235338094#comment39 12dontaudit toolbox virtualizationservice_data_file:dir setattr; 13 14# /dev/__null__ created by init prior to policy load, 15# open fd inherited by fsck. 16allow toolbox tmpfs:chr_file { read write ioctl }; 17 18# Inherit and use pty created by android_fork_execvp_ext(). 19allow toolbox devpts:chr_file { read write getattr ioctl }; 20 21# mkswap-specific. 22# Read/write block devices used for swap partitions. 23# Assign swap_block_device type any such partition in your 24# device/<vendor>/<product>/sepolicy/file_contexts file. 25allow toolbox block_device:dir search; 26allow toolbox swap_block_device:blk_file rw_file_perms; 27 28# rm -rf /data/per_boot 29allow toolbox system_data_root_file:dir { remove_name write }; 30allow toolbox system_data_file:dir { rmdir rw_dir_perms }; 31allow toolbox system_data_file:file { getattr unlink }; 32 33# chattr +F /data/media in init 34allow toolbox media_userdir_file:dir { r_dir_perms setattr }; 35allowxperm toolbox media_userdir_file:dir ioctl { FS_IOC_SETFLAGS FS_IOC_GETFLAGS }; 36 37### 38### Neverallow rules 39### 40 41# Only allow entry from init via the toolbox binary. 42neverallow { domain -init } toolbox:process transition; 43neverallow * toolbox:process dyntransition; 44neverallow toolbox { file_type fs_type -toolbox_exec}:file entrypoint; 45