xref: /aosp_15_r20/system/sepolicy/private/vold_prepare_subdirs.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)

domain_auto_trans(vold, vold_prepare_subdirs_exec, vold_prepare_subdirs)

typeattribute vold_prepare_subdirs coredomain;
typeattribute vold_prepare_subdirs mlstrustedsubject;

allow vold_prepare_subdirs system_file:file execute_no_trans;
allow vold_prepare_subdirs shell_exec:file rx_file_perms;
allow vold_prepare_subdirs toolbox_exec:file rx_file_perms;
allow vold_prepare_subdirs devpts:chr_file rw_file_perms;
allow vold_prepare_subdirs vold:fd use;
allow vold_prepare_subdirs vold:fifo_file { read write };
allow vold_prepare_subdirs file_contexts_file:file r_file_perms;
allow vold_prepare_subdirs seapp_contexts_file:file r_file_perms;
allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override dac_read_search fowner };
allow vold_prepare_subdirs self:process setfscreate;
allow vold_prepare_subdirs {
  sdk_sandbox_system_data_file
  system_data_file
  vendor_data_file
}:dir { open read write add_name remove_name rmdir relabelfrom };
allow vold_prepare_subdirs {
    apex_data_file_type
    apex_module_data_file
    apex_rollback_data_file
    backup_data_file
    checkin_data_file
    face_vendor_data_file
    fingerprint_vendor_data_file
    iris_vendor_data_file
    rollback_data_file
    is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_key_file')
    storaged_data_file
    sdk_sandbox_data_file
    sdk_sandbox_system_data_file
    system_data_file
    vold_data_file
}:dir { create_dir_perms relabelto };
allow vold_prepare_subdirs {
    apex_data_file_type
    apex_art_staging_data_file
    apex_module_data_file
    apex_rollback_data_file
    backup_data_file
    checkin_data_file
    face_vendor_data_file
    fingerprint_vendor_data_file
    iris_vendor_data_file
    rollback_data_file
    storaged_data_file
    sdk_sandbox_data_file
    system_data_file
    vold_data_file
}:file { getattr unlink };
allow vold_prepare_subdirs apex_mnt_dir:dir { open read };
allow vold_prepare_subdirs mnt_expand_file:dir search;
allow vold_prepare_subdirs user_profile_data_file:dir { search getattr relabelfrom };
allow vold_prepare_subdirs user_profile_root_file:dir { search getattr relabelfrom relabelto };

# Allow vold_prepare_subdirs to create storage area directories on behalf of apps.
is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
  allow vold_prepare_subdirs {
      storage_area_dir
      storage_area_app_dir
  }:dir {
      rw_dir_perms
      create
      setattr # for chown() and chmod()
      rmdir
      unlink
      relabelfrom # setfilecon
      relabelto # setfilecon
  };

  # The storage area directories should have type storage_area_dir
  type_transition vold_prepare_subdirs storage_area_app_dir:dir storage_area_dir;

  selinux_check_context(vold_prepare_subdirs)

  allowxperm vold_prepare_subdirs storage_area_dir:dir ioctl FS_IOC_SET_ENCRYPTION_POLICY;
')

is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
  neverallowxperm vold_prepare_subdirs {
    data_file_type
    -storage_area_dir
  }:dir ioctl FS_IOC_SET_ENCRYPTION_POLICY;
')

# Migrate legacy labels to apex_system_server_data_file (b/217581286)
allow vold_prepare_subdirs {
  apex_appsearch_data_file
  apex_permission_data_file
  apex_scheduling_data_file
  apex_tethering_data_file
  apex_wifi_data_file
}:dir relabelfrom;

# /data/misc is unlabeled during early boot.
allow vold_prepare_subdirs unlabeled:dir search;

dontaudit vold_prepare_subdirs { proc unlabeled }:file r_file_perms;