149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# storaged daemon 249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaletype storaged, domain, coredomain, mlstrustedsubject; 349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaletype storaged_exec, exec_type, file_type; 449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleinit_daemon_domain(storaged) 649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Read access to pseudo filesystems 849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaler_dir_file(storaged, proc_net) 949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaler_dir_file(storaged, domain) 1049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 1149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Read /proc/uid_io/stats 1249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow storaged proc_uid_io_stats:file r_file_perms; 1349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 1449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Read /data/system/packages.list 1549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow storaged system_data_file:file r_file_perms; 1649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 1749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Store storaged proto file 1849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow storaged storaged_data_file:dir rw_dir_perms; 1949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow storaged storaged_data_file:file create_file_perms; 2049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 2149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleuserdebug_or_eng(` 2249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale # Read access to debugfs 2349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale allow storaged debugfs_mmc:dir search; 2449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale allow storaged debugfs_mmc:file r_file_perms; 2549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale') 2649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 2749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Needed to provide debug dump output via dumpsys pipes. 2849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow storaged shell:fd use; 2949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow storaged shell:fifo_file write; 3049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 3149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Needed for GMScore to call dumpsys storaged 3249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow storaged priv_app:fd use; 3349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow storaged app_data_file:file write; 3449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow storaged permission_service:service_manager find; 3549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 3649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Binder permissions 3749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleadd_service(storaged, storaged_service) 3849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 3949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalebinder_use(storaged) 4049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalebinder_call(storaged, system_server) 4149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 4249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalehal_client_domain(storaged, hal_health) 4349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 4449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Implements a dumpsys interface. 4549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow storaged dumpstate:fd use; 4649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 4749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# use a subset of the package manager service 4849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow storaged package_native_service:service_manager find; 4949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 5049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Kernel does extra check on CAP_DAC_OVERRIDE for libbinder when storaged is 5149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# running as root. See b/35323867 #3. 5249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaledontaudit storaged self:global_capability_class_set dac_override; 5349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 5449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# For collecting bugreports. 5549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow storaged dumpstate:fifo_file write; 5649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 5749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### 5849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### neverallow 5949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### 6049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow storaged domain:process ptrace; 6149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow storaged self:capability_class_set *; 62