vold.te revision d7567118e92c7482d6a70c33d78af4cee2ddaef1
12dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalley# volume manager 22dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalleytype vold, domain; 32dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalleytype vold_exec, exec_type, file_type; 42dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalley 52dd4e51d5c2a2dfc0bfdee9303269f5a665f6e3Stephen Smalleyinit_daemon_domain(vold) 67914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 77914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichtypeattribute vold mlstrustedsubject; 87914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold system_file:file x_file_perms; 97914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold block_device:dir create_dir_perms; 107914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold block_device:blk_file create_file_perms; 117914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold device:dir write; 127914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold devpts:chr_file rw_file_perms; 137914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold rootfs:dir mounton; 147914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold sdcard_type:dir mounton; 157914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold sdcard_type:filesystem { mount remount unmount }; 167914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold sdcard_type:dir create_dir_perms; 1780176dc44570c15c786e6129a7f9ae1fa9d1c27aJeff Sharkeyallow vold sdcard_type:file create_file_perms; 187914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold tmpfs:filesystem { mount unmount }; 197914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold tmpfs:dir create_dir_perms; 207914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold tmpfs:dir mounton; 21b25fe91e2576fc22310f8d9c9bc33ef08c6972f2Alex Klyubinallow vold self:capability { net_admin dac_override mknod sys_admin chown fowner fsetid }; 221601132086b054adc70e7f8f38ed24574c90bc37Stephen Smalleyallow vold self:netlink_kobject_uevent_socket create_socket_perms; 237914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold app_data_file:dir search; 247914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold app_data_file:file rw_file_perms; 257914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold loop_device:blk_file rw_file_perms; 267914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold dm_device:chr_file rw_file_perms; 277914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# For vold Process::killProcessesWithOpenFiles function. 287914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold domain:dir r_dir_perms; 297914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold domain:{ file lnk_file } r_file_perms; 307914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold domain:process { signal sigkill }; 317eb786bca26230f11472299947b815472bc1e333Geremy Condraallow vold self:capability { sys_ptrace kill }; 327914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 332abfe7d4f72b0265b1dec31e675650c77998f4d6Jeff Sharkey# For blkid 342abfe7d4f72b0265b1dec31e675650c77998f4d6Jeff Sharkeyallow vold shell_exec:file rx_file_perms; 352abfe7d4f72b0265b1dec31e675650c77998f4d6Jeff Sharkey 367914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# XXX Label sysfs files with a specific type? 377914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold sysfs:file rw_file_perms; 387914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 397914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichwrite_klog(vold) 407914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 413753c816b25447d2eb76aea96030c92b7d962046Nick Kralevich# Log fsck results 423753c816b25447d2eb76aea96030c92b7d962046Nick Kralevichallow vold fscklogs:dir rw_dir_perms; 433753c816b25447d2eb76aea96030c92b7d962046Nick Kralevichallow vold fscklogs:file create_file_perms; 443753c816b25447d2eb76aea96030c92b7d962046Nick Kralevich 457914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# 467914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# Rules to support encrypted fs support. 477914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# 487914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 497914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# Set property. 507914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichunix_socket_connect(vold, property, init) 517914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 527914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# Unmount and mount the fs. 537914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold labeledfs:filesystem { mount unmount remount }; 547914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 557914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# Access /efs/userdata_footer. 567914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# XXX Split into a separate type? 577914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold efs_file:file rw_file_perms; 587914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 597914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# Create and mount on /data/tmp_mnt. 607914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold system_data_file:dir { create rw_dir_perms mounton }; 617914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 627914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# Set scheduling policy of kernel processes 637914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold kernel:process setsched; 647914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 657914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# Property Service 667914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold vold_prop:property_service set; 677914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold powerctl_prop:property_service set; 684b3893f90bf6bc67de232ddc44123974d36770efRobert Craigallow vold ctl_fuse_prop:property_service set; 697914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich 707914a47f05ac4f00928062d08275fe4680f1747cNick Kralevich# ASEC 717914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold asec_image_file:file create_file_perms; 727914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichallow vold asec_image_file:dir rw_dir_perms; 737914a47f05ac4f00928062d08275fe4680f1747cNick Kralevichsecurity_access_policy(vold) 7448b18832c476f0bd8fcb8ee3e308258392f36aafRobert Craigrelabelto_domain(vold) 7548b18832c476f0bd8fcb8ee3e308258392f36aafRobert Craigallow vold asec_apk_file:dir { rw_dir_perms setattr relabelfrom }; 7648b18832c476f0bd8fcb8ee3e308258392f36aafRobert Craigallow vold asec_public_file:dir { relabelto setattr }; 7748b18832c476f0bd8fcb8ee3e308258392f36aafRobert Craigallow vold asec_apk_file:file { r_file_perms setattr relabelfrom }; 7848b18832c476f0bd8fcb8ee3e308258392f36aafRobert Craigallow vold asec_public_file:file { relabelto setattr }; 793753c816b25447d2eb76aea96030c92b7d962046Nick Kralevich 803753c816b25447d2eb76aea96030c92b7d962046Nick Kralevich# Handle wake locks (used for device encryption) 813753c816b25447d2eb76aea96030c92b7d962046Nick Kralevichallow vold sysfs_wake_lock:file rw_file_perms; 823753c816b25447d2eb76aea96030c92b7d962046Nick Kralevichallow vold self:capability2 block_suspend; 8301ba6834c10f5839371385b224a78c04e1351202Paul Lawrence 8401ba6834c10f5839371385b224a78c04e1351202Paul Lawrence# talk to batteryservice 8501ba6834c10f5839371385b224a78c04e1351202Paul Lawrencebinder_use(vold) 8601ba6834c10f5839371385b224a78c04e1351202Paul Lawrencebinder_call(vold, healthd) 87d7567118e92c7482d6a70c33d78af4cee2ddaef1Paul Lawrence 88d7567118e92c7482d6a70c33d78af4cee2ddaef1Paul Lawrence# talk to keymaster 89d7567118e92c7482d6a70c33d78af4cee2ddaef1Paul Lawrenceallow vold tee_device:chr_file rw_file_perms; 90d7567118e92c7482d6a70c33d78af4cee2ddaef1Paul Lawrence 91