1*e4a36f41SAndroid Build Coastguard Workertypeattribute toolbox coredomain; 2*e4a36f41SAndroid Build Coastguard Worker 3*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(toolbox) 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Worker# rm -rf in /data/misc/virtualizationservice 6*e4a36f41SAndroid Build Coastguard Workerallow toolbox virtualizationservice_data_file:dir { rmdir rw_dir_perms }; 7*e4a36f41SAndroid Build Coastguard Workerallow toolbox virtualizationservice_data_file:file { getattr unlink }; 8*e4a36f41SAndroid Build Coastguard Worker 9*e4a36f41SAndroid Build Coastguard Worker# If we can't remove these directories we try to chmod them. That 10*e4a36f41SAndroid Build Coastguard Worker# doesn't work, but it doesn't matter as virtualizationservice itself 11*e4a36f41SAndroid Build Coastguard Worker# will delete them when it starts. See b/235338094#comment39 12*e4a36f41SAndroid Build Coastguard Workerdontaudit toolbox virtualizationservice_data_file:dir setattr; 13*e4a36f41SAndroid Build Coastguard Worker 14*e4a36f41SAndroid Build Coastguard Worker# /dev/__null__ created by init prior to policy load, 15*e4a36f41SAndroid Build Coastguard Worker# open fd inherited by fsck. 16*e4a36f41SAndroid Build Coastguard Workerallow toolbox tmpfs:chr_file { read write ioctl }; 17*e4a36f41SAndroid Build Coastguard Worker 18*e4a36f41SAndroid Build Coastguard Worker# Inherit and use pty created by android_fork_execvp_ext(). 19*e4a36f41SAndroid Build Coastguard Workerallow toolbox devpts:chr_file { read write getattr ioctl }; 20*e4a36f41SAndroid Build Coastguard Worker 21*e4a36f41SAndroid Build Coastguard Worker# mkswap-specific. 22*e4a36f41SAndroid Build Coastguard Worker# Read/write block devices used for swap partitions. 23*e4a36f41SAndroid Build Coastguard Worker# Assign swap_block_device type any such partition in your 24*e4a36f41SAndroid Build Coastguard Worker# device/<vendor>/<product>/sepolicy/file_contexts file. 25*e4a36f41SAndroid Build Coastguard Workerallow toolbox block_device:dir search; 26*e4a36f41SAndroid Build Coastguard Workerallow toolbox swap_block_device:blk_file rw_file_perms; 27*e4a36f41SAndroid Build Coastguard Worker 28*e4a36f41SAndroid Build Coastguard Worker# rm -rf /data/per_boot 29*e4a36f41SAndroid Build Coastguard Workerallow toolbox system_data_root_file:dir { remove_name write }; 30*e4a36f41SAndroid Build Coastguard Workerallow toolbox system_data_file:dir { rmdir rw_dir_perms }; 31*e4a36f41SAndroid Build Coastguard Workerallow toolbox system_data_file:file { getattr unlink }; 32*e4a36f41SAndroid Build Coastguard Worker 33*e4a36f41SAndroid Build Coastguard Worker# chattr +F /data/media in init 34*e4a36f41SAndroid Build Coastguard Workerallow toolbox media_userdir_file:dir { r_dir_perms setattr }; 35*e4a36f41SAndroid Build Coastguard Workerallowxperm toolbox media_userdir_file:dir ioctl { FS_IOC_SETFLAGS FS_IOC_GETFLAGS }; 36*e4a36f41SAndroid Build Coastguard Worker 37*e4a36f41SAndroid Build Coastguard Worker### 38*e4a36f41SAndroid Build Coastguard Worker### Neverallow rules 39*e4a36f41SAndroid Build Coastguard Worker### 40*e4a36f41SAndroid Build Coastguard Worker 41*e4a36f41SAndroid Build Coastguard Worker# Only allow entry from init via the toolbox binary. 42*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -init } toolbox:process transition; 43*e4a36f41SAndroid Build Coastguard Workerneverallow * toolbox:process dyntransition; 44*e4a36f41SAndroid Build Coastguard Workerneverallow toolbox { file_type fs_type -toolbox_exec}:file entrypoint; 45