1# volume manager 2type vold, domain; 3type vold_exec, exec_type, file_type; 4 5# Read already opened /cache files. 6allow vold cache_file:dir r_dir_perms; 7allow vold cache_file:file { getattr read }; 8allow vold cache_file:lnk_file r_file_perms; 9 10# Read access to pseudo filesystems. 11r_dir_file(vold, proc) 12r_dir_file(vold, proc_net) 13r_dir_file(vold, sysfs_type) 14# XXX Label sysfs files with a specific type? 15allow vold sysfs:file w_file_perms; 16allow vold sysfs_usb:file w_file_perms; 17allow vold sysfs_zram_uevent:file w_file_perms; 18 19r_dir_file(vold, rootfs) 20allow vold proc_meminfo:file r_file_perms; 21 22#Get file contexts 23allow vold file_contexts_file:file r_file_perms; 24 25# Allow us to jump into execution domains of above tools 26allow vold self:process setexec; 27 28# For sgdisk launched through popen() 29allow vold shell_exec:file rx_file_perms; 30 31typeattribute vold mlstrustedsubject; 32allow vold self:process setfscreate; 33allow vold system_file:file x_file_perms; 34not_full_treble(`allow vold vendor_file:file x_file_perms;') 35allow vold block_device:dir create_dir_perms; 36allow vold device:dir write; 37allow vold devpts:chr_file rw_file_perms; 38allow vold rootfs:dir mounton; 39allow vold sdcard_type:dir mounton; # TODO: deprecated in M 40allow vold sdcard_type:filesystem { mount remount unmount }; # TODO: deprecated in M 41allow vold sdcard_type:dir create_dir_perms; # TODO: deprecated in M 42allow vold sdcard_type:file create_file_perms; # TODO: deprecated in M 43 44# Manage locations where storage is mounted 45allow vold { mnt_media_rw_file storage_file sdcard_type }:dir create_dir_perms; 46allow vold { mnt_media_rw_file storage_file sdcard_type }:file create_file_perms; 47 48# Access to storage that backs emulated FUSE daemons for migration optimization 49allow vold media_rw_data_file:dir create_dir_perms; 50allow vold media_rw_data_file:file create_file_perms; 51 52# Allow mounting of storage devices 53allow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr }; 54 55# Manage per-user primary symlinks 56allow vold mnt_user_file:dir create_dir_perms; 57allow vold mnt_user_file:lnk_file create_file_perms; 58 59# Allow to create and mount expanded storage 60allow vold mnt_expand_file:dir { create_dir_perms mounton }; 61allow vold apk_data_file:dir { create getattr setattr }; 62allow vold shell_data_file:dir { create getattr setattr }; 63 64allow vold tmpfs:filesystem { mount unmount }; 65allow vold tmpfs:dir create_dir_perms; 66allow vold tmpfs:dir mounton; 67allow vold self:capability { net_admin dac_override mknod sys_admin chown fowner fsetid }; 68allow vold self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; 69allow vold app_data_file:dir search; 70allow vold app_data_file:file rw_file_perms; 71allow vold loop_control_device:chr_file rw_file_perms; 72allow vold loop_device:blk_file { create setattr unlink rw_file_perms }; 73allow vold vold_device:blk_file { create setattr unlink rw_file_perms }; 74allow vold dm_device:chr_file rw_file_perms; 75allow vold dm_device:blk_file rw_file_perms; 76# For vold Process::killProcessesWithOpenFiles function. 77allow vold domain:dir r_dir_perms; 78allow vold domain:{ file lnk_file } r_file_perms; 79allow vold domain:process { signal sigkill }; 80allow vold self:capability { sys_ptrace kill }; 81 82# XXX Label sysfs files with a specific type? 83allow vold sysfs:file rw_file_perms; 84 85allow vold kmsg_device:chr_file rw_file_perms; 86 87# Run fsck in the fsck domain. 88allow vold fsck_exec:file { r_file_perms execute }; 89 90# Log fsck results 91allow vold fscklogs:dir rw_dir_perms; 92allow vold fscklogs:file create_file_perms; 93 94# 95# Rules to support encrypted fs support. 96# 97 98# Unmount and mount the fs. 99allow vold labeledfs:filesystem { mount unmount }; 100 101# Access /efs/userdata_footer. 102# XXX Split into a separate type? 103allow vold efs_file:file rw_file_perms; 104 105# Create and mount on /data/tmp_mnt and management of expansion mounts 106allow vold system_data_file:dir { create rw_dir_perms mounton setattr rmdir }; 107 108# Set scheduling policy of kernel processes 109allow vold kernel:process setsched; 110 111# Property Service 112set_prop(vold, vold_prop) 113set_prop(vold, powerctl_prop) 114set_prop(vold, ctl_fuse_prop) 115set_prop(vold, restorecon_prop) 116 117# ASEC 118allow vold asec_image_file:file create_file_perms; 119allow vold asec_image_file:dir rw_dir_perms; 120allow vold asec_apk_file:dir { create_dir_perms mounton relabelfrom relabelto }; 121allow vold asec_public_file:dir { relabelto setattr }; 122allow vold asec_apk_file:file { r_file_perms setattr relabelfrom relabelto }; 123allow vold asec_public_file:file { relabelto setattr }; 124# restorecon files in asec containers created on 4.2 or earlier. 125allow vold unlabeled:dir { r_dir_perms setattr relabelfrom }; 126allow vold unlabeled:file { r_file_perms setattr relabelfrom }; 127 128# Handle wake locks (used for device encryption) 129wakelock_use(vold) 130 131# talk to batteryservice 132binder_use(vold) 133binder_call(vold, healthd) 134 135# talk to keymaster 136hal_client_domain(vold, hal_keymaster) 137 138# Access userdata block device. 139allow vold userdata_block_device:blk_file rw_file_perms; 140 141# Access metadata block device used for encryption meta-data. 142allow vold metadata_block_device:blk_file rw_file_perms; 143 144# Allow vold to manipulate /data/unencrypted 145allow vold unencrypted_data_file:{ file } create_file_perms; 146allow vold unencrypted_data_file:dir create_dir_perms; 147 148# Write to /proc/sys/vm/drop_caches 149allow vold proc_drop_caches:file w_file_perms; 150 151# Give vold a place where only vold can store files; everyone else is off limits 152allow vold vold_data_file:dir create_dir_perms; 153allow vold vold_data_file:file create_file_perms; 154 155# linux keyring configuration 156allow vold init:key { write search setattr }; 157allow vold vold:key { write search setattr }; 158 159# vold temporarily changes its priority when running benchmarks 160allow vold self:capability sys_nice; 161 162# vold needs to chroot into app namespaces to remount when runtime permissions change 163allow vold self:capability sys_chroot; 164allow vold storage_file:dir mounton; 165 166# For AppFuse. 167allow vold fuse_device:chr_file rw_file_perms; 168allow vold fuse:filesystem { relabelfrom }; 169allow vold app_fusefs:filesystem { relabelfrom relabelto }; 170allow vold app_fusefs:filesystem { mount unmount }; 171 172# MoveTask.cpp executes cp and rm 173allow vold toolbox_exec:file rx_file_perms; 174 175# Prepare profile dir for users. 176allow vold user_profile_data_file:dir create_dir_perms; 177 178# Raw writes to misc block device 179allow vold misc_block_device:blk_file w_file_perms; 180 181neverallow { domain -vold } vold_data_file:dir ~{ open create read getattr setattr search relabelto ioctl }; 182neverallow { domain -vold -kernel } vold_data_file:notdevfile_class_set ~{ relabelto getattr }; 183neverallow { domain -vold -init } vold_data_file:dir *; 184neverallow { domain -vold -init -kernel } vold_data_file:notdevfile_class_set *; 185neverallow { domain -vold -init } restorecon_prop:property_service set; 186 187neverallow vold fsck_exec:file execute_no_trans; 188