vold.te revision 626f90c541add3560e5eb23cca6c2c9d6cebdcf4
12dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalley# volume manager 2d22987b4daf02a8dae5bb10119d9ec5ec9f637cfJeff Vander Stoeptype vold, domain, domain_deprecated; 32dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalleytype vold_exec, exec_type, file_type; 42dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalley 59306072c97db7aadda86baf1eb402d7e36baf6fcJeff Vander Stoep# Read already opened /cache files. 69306072c97db7aadda86baf1eb402d7e36baf6fcJeff Vander Stoepallow vold cache_file:dir r_dir_perms; 79306072c97db7aadda86baf1eb402d7e36baf6fcJeff Vander Stoepallow vold cache_file:file { getattr read }; 89306072c97db7aadda86baf1eb402d7e36baf6fcJeff Vander Stoepallow vold cache_file:lnk_file r_file_perms; 99306072c97db7aadda86baf1eb402d7e36baf6fcJeff Vander Stoep 109306072c97db7aadda86baf1eb402d7e36baf6fcJeff Vander Stoep# Read access to pseudo filesystems. 119306072c97db7aadda86baf1eb402d7e36baf6fcJeff Vander Stoepr_dir_file(vold, proc) 129306072c97db7aadda86baf1eb402d7e36baf6fcJeff Vander Stoepr_dir_file(vold, proc_net) 137ef80731f20bdafc23eb5bedeb063247933fc8aaJeff Vander Stoepr_dir_file(vold, sysfs_type) 147ef80731f20bdafc23eb5bedeb063247933fc8aaJeff Vander Stoep# XXX Label sysfs files with a specific type? 157ef80731f20bdafc23eb5bedeb063247933fc8aaJeff Vander Stoepallow vold sysfs:file w_file_perms; 167ef80731f20bdafc23eb5bedeb063247933fc8aaJeff Vander Stoepallow vold sysfs_usb:file w_file_perms; 177ef80731f20bdafc23eb5bedeb063247933fc8aaJeff Vander Stoepallow vold sysfs_zram_uevent:file w_file_perms; 187ef80731f20bdafc23eb5bedeb063247933fc8aaJeff Vander Stoep 199306072c97db7aadda86baf1eb402d7e36baf6fcJeff Vander Stoepr_dir_file(vold, rootfs) 207ef80731f20bdafc23eb5bedeb063247933fc8aaJeff Vander Stoepallow vold proc_meminfo:file r_file_perms; 219306072c97db7aadda86baf1eb402d7e36baf6fcJeff Vander Stoep 2284e1c61193cf880ff899c4c34f9140c2e23c7811Jeff Sharkey# Allow us to jump into execution domains of above tools 2384e1c61193cf880ff899c4c34f9140c2e23c7811Jeff Sharkeyallow vold self:process setexec; 2484e1c61193cf880ff899c4c34f9140c2e23c7811Jeff Sharkey 2584e1c61193cf880ff899c4c34f9140c2e23c7811Jeff Sharkey# For sgdisk launched through popen() 2684e1c61193cf880ff899c4c34f9140c2e23c7811Jeff Sharkeyallow vold shell_exec:file rx_file_perms; 27f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkey 287914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichtypeattribute vold mlstrustedsubject; 29273d7ea4ca29fbd71c2b01e69e2c5ebd1253470aStephen Smalleyallow vold self:process setfscreate; 307914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold system_file:file x_file_perms; 317914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold block_device:dir create_dir_perms; 327914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold device:dir write; 337914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold devpts:chr_file rw_file_perms; 347914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold rootfs:dir mounton; 35f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkeyallow vold sdcard_type:dir mounton; # TODO: deprecated in M 36f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkeyallow vold sdcard_type:filesystem { mount remount unmount }; # TODO: deprecated in M 37f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkeyallow vold sdcard_type:dir create_dir_perms; # TODO: deprecated in M 38f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkeyallow vold sdcard_type:file create_file_perms; # TODO: deprecated in M 39f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkey 40f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkey# Manage locations where storage is mounted 41f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkeyallow vold { mnt_media_rw_file storage_file sdcard_type }:dir create_dir_perms; 42f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkeyallow vold { mnt_media_rw_file storage_file sdcard_type }:file create_file_perms; 43f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkey 4490c64542a20b23180c36b9bb07b78c1ff06350a1Jeff Sharkey# Access to storage that backs emulated FUSE daemons for migration optimization 4590c64542a20b23180c36b9bb07b78c1ff06350a1Jeff Sharkeyallow vold media_rw_data_file:dir create_dir_perms; 4690c64542a20b23180c36b9bb07b78c1ff06350a1Jeff Sharkeyallow vold media_rw_data_file:file create_file_perms; 4790c64542a20b23180c36b9bb07b78c1ff06350a1Jeff Sharkey 48f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkey# Allow mounting of storage devices 49f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkeyallow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr }; 50f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkey 51f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkey# Manage per-user primary symlinks 52f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkeyallow vold mnt_user_file:dir create_dir_perms; 53f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkeyallow vold mnt_user_file:lnk_file create_file_perms; 54f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkey 5573d9c2a97b232389ab1dd179ac72c2fbefc5482bJeff Sharkey# Allow to create and mount expanded storage 5673d9c2a97b232389ab1dd179ac72c2fbefc5482bJeff Sharkeyallow vold mnt_expand_file:dir { create_dir_perms mounton }; 5773d9c2a97b232389ab1dd179ac72c2fbefc5482bJeff Sharkeyallow vold apk_data_file:dir { create getattr setattr }; 5873d9c2a97b232389ab1dd179ac72c2fbefc5482bJeff Sharkeyallow vold shell_data_file:dir { create getattr setattr }; 5973d9c2a97b232389ab1dd179ac72c2fbefc5482bJeff Sharkey 607914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold tmpfs:filesystem { mount unmount }; 617914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold tmpfs:dir create_dir_perms; 627914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold tmpfs:dir mounton; 63b25fe91e2576fc22310f8d9c9bc33ef08c6972f2Alex Klyubinallow vold self:capability { net_admin dac_override mknod sys_admin chown fowner fsetid }; 64bff9801521abb36a243131114e70f905fb1238efJeff Vander Stoepallow vold self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; 657914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold app_data_file:dir search; 667914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold app_data_file:file rw_file_perms; 67626f90c541add3560e5eb23cca6c2c9d6cebdcf4Max Biresallow vold loop_device:blk_file { create setattr unlink rw_file_perms }; 68626f90c541add3560e5eb23cca6c2c9d6cebdcf4Max Biresallow vold vold_device:blk_file { create setattr unlink rw_file_perms }; 697914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold dm_device:chr_file rw_file_perms; 70273d7ea4ca29fbd71c2b01e69e2c5ebd1253470aStephen Smalleyallow vold dm_device:blk_file rw_file_perms; 717914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# For vold Process::killProcessesWithOpenFiles function. 727914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold domain:dir r_dir_perms; 737914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold domain:{ file lnk_file } r_file_perms; 747914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold domain:process { signal sigkill }; 757eb786bca26230f11472299947b815472bc1e333Geremy Condraallow vold self:capability { sys_ptrace kill }; 767914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 777914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# XXX Label sysfs files with a specific type? 787914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold sysfs:file rw_file_perms; 797914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 80e2651972c13a2aa3f930f5c39d81d41177387bf0Nick Kralevichallow vold kmsg_device:chr_file rw_file_perms; 817914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 8267d9932c6744885ee0ef3bab61bbae3b8f16de9bJeff Vander Stoep# Run fsck in the fsck domain. 8367d9932c6744885ee0ef3bab61bbae3b8f16de9bJeff Vander Stoepallow vold fsck_exec:file { r_file_perms execute }; 84cedee697c3683ac267c0933200e6727f0910d2e6Stephen Smalley 853753c816b25447d2eb76aea96030c92b7d962046Nick Kralevich# Log fsck results 863753c816b25447d2eb76aea96030c92b7d962046Nick Kralevichallow vold fscklogs:dir rw_dir_perms; 873753c816b25447d2eb76aea96030c92b7d962046Nick Kralevichallow vold fscklogs:file create_file_perms; 883753c816b25447d2eb76aea96030c92b7d962046Nick Kralevich 897ef80731f20bdafc23eb5bedeb063247933fc8aaJeff Vander Stoepallow vold ion_device:chr_file r_file_perms; 907ef80731f20bdafc23eb5bedeb063247933fc8aaJeff Vander Stoep 917914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# 927914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# Rules to support encrypted fs support. 937914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# 947914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 957914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# Unmount and mount the fs. 9616c889c51f0667c7d063f959922b5c98bcebfd7aMaxallow vold labeledfs:filesystem { mount unmount }; 977914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 987914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# Access /efs/userdata_footer. 997914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# XXX Split into a separate type? 1007914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold efs_file:file rw_file_perms; 1017914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 10273d9c2a97b232389ab1dd179ac72c2fbefc5482bJeff Sharkey# Create and mount on /data/tmp_mnt and management of expansion mounts 10373d9c2a97b232389ab1dd179ac72c2fbefc5482bJeff Sharkeyallow vold system_data_file:dir { create rw_dir_perms mounton setattr rmdir }; 1047914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 1057914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# Set scheduling policy of kernel processes 1067914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold kernel:process setsched; 1077914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 1087914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# Property Service 1092f5a6a96bdc284dc070a2c222243dd8e19edb9efWilliam Robertsset_prop(vold, vold_prop) 1102f5a6a96bdc284dc070a2c222243dd8e19edb9efWilliam Robertsset_prop(vold, powerctl_prop) 1112f5a6a96bdc284dc070a2c222243dd8e19edb9efWilliam Robertsset_prop(vold, ctl_fuse_prop) 1127617cd48b7b67bfacab5f574064a1f3d2a4f82e1Jeff Sharkeyset_prop(vold, restorecon_prop) 1137914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 1147914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# ASEC 1157914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold asec_image_file:file create_file_perms; 1167914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold asec_image_file:dir rw_dir_perms; 117f063f461a9e5b6049f3516e48806b6a87848ac1aJeff Sharkeyallow vold asec_apk_file:dir { create_dir_perms mounton relabelfrom relabelto }; 11848b18832c476f0bd8fcb8ee3e308258392f36aafRobert Craigallow vold asec_public_file:dir { relabelto setattr }; 119f85c1fc293523db241c48d815b165067b8a0f471Stephen Smalleyallow vold asec_apk_file:file { r_file_perms setattr relabelfrom relabelto }; 12048b18832c476f0bd8fcb8ee3e308258392f36aafRobert Craigallow vold asec_public_file:file { relabelto setattr }; 121f85c1fc293523db241c48d815b165067b8a0f471Stephen Smalley# restorecon files in asec containers created on 4.2 or earlier. 122f85c1fc293523db241c48d815b165067b8a0f471Stephen Smalleyallow vold unlabeled:dir { r_dir_perms setattr relabelfrom }; 123f85c1fc293523db241c48d815b165067b8a0f471Stephen Smalleyallow vold unlabeled:file { r_file_perms setattr relabelfrom }; 1243753c816b25447d2eb76aea96030c92b7d962046Nick Kralevich 1253753c816b25447d2eb76aea96030c92b7d962046Nick Kralevich# Handle wake locks (used for device encryption) 1268599e34b95705638034b798c56bc2cc8bb2e6372Nick Kralevichwakelock_use(vold) 12701ba6834c10f5839371385b224a78c04e1351202Paul Lawrence 12801ba6834c10f5839371385b224a78c04e1351202Paul Lawrence# talk to batteryservice 12901ba6834c10f5839371385b224a78c04e1351202Paul Lawrencebinder_use(vold) 13001ba6834c10f5839371385b224a78c04e1351202Paul Lawrencebinder_call(vold, healthd) 131d7567118e92c7482d6a70c33d78af4cee2ddaef1Paul Lawrence 132d7567118e92c7482d6a70c33d78af4cee2ddaef1Paul Lawrence# talk to keymaster 133d7567118e92c7482d6a70c33d78af4cee2ddaef1Paul Lawrenceallow vold tee_device:chr_file rw_file_perms; 134d7567118e92c7482d6a70c33d78af4cee2ddaef1Paul Lawrence 135dd053a9b891195439b1c0848cb0e8a6e17b4b9bcStephen Smalley# Access userdata block device. 136dd053a9b891195439b1c0848cb0e8a6e17b4b9bcStephen Smalleyallow vold userdata_block_device:blk_file rw_file_perms; 137273d7ea4ca29fbd71c2b01e69e2c5ebd1253470aStephen Smalley 138273d7ea4ca29fbd71c2b01e69e2c5ebd1253470aStephen Smalley# Access metadata block device used for encryption meta-data. 139273d7ea4ca29fbd71c2b01e69e2c5ebd1253470aStephen Smalleyallow vold metadata_block_device:blk_file rw_file_perms; 14038af1da10785c3c4056e148652d565a7187614eaPaul Lawrence 141e2c0c9de7b99ed5cd2349e0585284fd6a0ad768aPaul Lawrence# Allow vold to manipulate /data/unencrypted 142e2c0c9de7b99ed5cd2349e0585284fd6a0ad768aPaul Lawrenceallow vold unencrypted_data_file:{ file } create_file_perms; 14338af1da10785c3c4056e148652d565a7187614eaPaul Lawrenceallow vold unencrypted_data_file:dir create_dir_perms; 1444423ecdb093abefecfc208824f2ae9d66eeae873Jeff Sharkey 145c960596cc346a94d15dcfff51a7e25ddf4edbd19Jeff Sharkey# Write to /proc/sys/vm/drop_caches 146c960596cc346a94d15dcfff51a7e25ddf4edbd19Jeff Sharkeyallow vold proc_drop_caches:file w_file_perms; 147c960596cc346a94d15dcfff51a7e25ddf4edbd19Jeff Sharkey 1484423ecdb093abefecfc208824f2ae9d66eeae873Jeff Sharkey# Give vold a place where only vold can store files; everyone else is off limits 149c960596cc346a94d15dcfff51a7e25ddf4edbd19Jeff Sharkeyallow vold vold_data_file:dir create_dir_perms; 1504423ecdb093abefecfc208824f2ae9d66eeae873Jeff Sharkeyallow vold vold_data_file:file create_file_perms; 1514423ecdb093abefecfc208824f2ae9d66eeae873Jeff Sharkey 152e2c0c9de7b99ed5cd2349e0585284fd6a0ad768aPaul Lawrence# linux keyring configuration 153e2c0c9de7b99ed5cd2349e0585284fd6a0ad768aPaul Lawrenceallow vold init:key { write search setattr }; 154e2c0c9de7b99ed5cd2349e0585284fd6a0ad768aPaul Lawrenceallow vold vold:key { write search setattr }; 155e2c0c9de7b99ed5cd2349e0585284fd6a0ad768aPaul Lawrence 156769b96f2e361fa9a27895be6a7bcad5a2a4811f4Jeff Sharkey# vold temporarily changes its priority when running benchmarks 157769b96f2e361fa9a27895be6a7bcad5a2a4811f4Jeff Sharkeyallow vold self:capability sys_nice; 158769b96f2e361fa9a27895be6a7bcad5a2a4811f4Jeff Sharkey 1596b75d099e17dad2cf691e0a31a084d4d15d5b5abJeff Sharkey# vold needs to chroot into app namespaces to remount when runtime permissions change 1606b75d099e17dad2cf691e0a31a084d4d15d5b5abJeff Sharkeyallow vold self:capability sys_chroot; 1616b75d099e17dad2cf691e0a31a084d4d15d5b5abJeff Sharkeyallow vold storage_file:dir mounton; 1626b75d099e17dad2cf691e0a31a084d4d15d5b5abJeff Sharkey 163a20802ddb87befbbd80d19e0a206aeb493528319Daichi Hirono# For AppFuse. 164a20802ddb87befbbd80d19e0a206aeb493528319Daichi Hironoallow vold fuse_device:chr_file rw_file_perms; 165e178ac5a7147f6f808844ab9ba4f0d6eb948cb88Daichi Hironoallow vold fuse:filesystem { relabelfrom }; 166e178ac5a7147f6f808844ab9ba4f0d6eb948cb88Daichi Hironoallow vold app_fusefs:filesystem { relabelfrom relabelto }; 167e178ac5a7147f6f808844ab9ba4f0d6eb948cb88Daichi Hironoallow vold app_fusefs:filesystem { mount unmount }; 168a20802ddb87befbbd80d19e0a206aeb493528319Daichi Hirono 169d1f8f731ea5c35316c8349c31ff9723e52ba7e52Jeff Vander Stoep# MoveTask.cpp executes cp and rm 170d1f8f731ea5c35316c8349c31ff9723e52ba7e52Jeff Vander Stoepallow vold toolbox_exec:file rx_file_perms; 171d1f8f731ea5c35316c8349c31ff9723e52ba7e52Jeff Vander Stoep 17289625c9a6488d01466e5b21856f8fdede047f128Calin Juravle# Prepare profile dir for users. 17389625c9a6488d01466e5b21856f8fdede047f128Calin Juravleallow vold user_profile_data_file:dir create_dir_perms; 174cfb36df7c7262206848436995e2c3e576ae362afCalin Juravleallow vold user_profile_foreign_dex_data_file:dir { getattr setattr }; 17589625c9a6488d01466e5b21856f8fdede047f128Calin Juravle 176c1a23d04977ed2f073eaf25a86f739ab1d3ce9deYabin Cui# Raw writes to misc block device 177c1a23d04977ed2f073eaf25a86f739ab1d3ce9deYabin Cuiallow vold misc_block_device:blk_file w_file_perms; 178c1a23d04977ed2f073eaf25a86f739ab1d3ce9deYabin Cui 17935e50159ad8392362910a9e33d76047d22682f04Paul Lawrenceneverallow { domain -vold } vold_data_file:dir ~{ open create read getattr setattr search relabelto ioctl }; 1804423ecdb093abefecfc208824f2ae9d66eeae873Jeff Sharkeyneverallow { domain -vold } vold_data_file:notdevfile_class_set ~{ relabelto getattr }; 1814423ecdb093abefecfc208824f2ae9d66eeae873Jeff Sharkeyneverallow { domain -vold -init } vold_data_file:dir *; 1824423ecdb093abefecfc208824f2ae9d66eeae873Jeff Sharkeyneverallow { domain -vold -init } vold_data_file:notdevfile_class_set *; 1837617cd48b7b67bfacab5f574064a1f3d2a4f82e1Jeff Sharkeyneverallow { domain -vold -init } restorecon_prop:property_service set; 18467d9932c6744885ee0ef3bab61bbae3b8f16de9bJeff Vander Stoep 18567d9932c6744885ee0ef3bab61bbae3b8f16de9bJeff Vander Stoepneverallow vold fsck_exec:file execute_no_trans; 186