platform_system_sepolicy/public/vdc.te

# vdc spawned from init for the following services:
#  defaultcrypto
#  encrypt
#
# We also transition into this domain from dumpstate, when
# collecting bug reports.

type vdc, domain;
type vdc_exec, exec_type, file_type;

# vdc can be invoked with logwrapper, so let it write to pty
allow vdc devpts:chr_file rw_file_perms;

# vdc writes directly to kmsg during the boot process
allow vdc kmsg_device:chr_file w_file_perms;

# vdc talks to vold over Binder
binder_use(vdc)
binder_call(vdc, vold)
allow vdc vold_service:service_manager find;
Create vdc domain The init.rc one-shot services "defaultcrypto" and "encrypt" call out to the /system/bin/vdc command line to ask vold to perform encryption operations. Create a new domain for these one-shot services. Allow the vdc domain to talk to vold. Change-Id: I73dc2ee4cc265bc16056b27307c254254940fd9f 2014-06-21 03:11:11 +02:00			`# vdc spawned from init for the following services:`
			`# defaultcrypto`
			`# encrypt`
dumpstate: transition into vdc domain dumpstate uses vdc to collect asec lists and do a vold dump. Force a transition into the vdc domain when this occurs. Addresses the following denial: <4>[ 1099.623572] type=1400 audit(1403716545.565:7): avc: denied { execute } for pid=6987 comm="dumpstate" name="vdc" dev="mmcblk0p8" ino=222 scontext=u:r:dumpstate:s0 tcontext=u:object_r:vdc_exec:s0 tclass=file permissive=0 Change-Id: I4bd9f3ad83480f8c9f9843ffe136295c582f96fe 2014-06-25 21:30:11 +02:00			`#`
			`# We also transition into this domain from dumpstate, when`
			`# collecting bug reports.`
Create vdc domain The init.rc one-shot services "defaultcrypto" and "encrypt" call out to the /system/bin/vdc command line to ask vold to perform encryption operations. Create a new domain for these one-shot services. Allow the vdc domain to talk to vold. Change-Id: I73dc2ee4cc265bc16056b27307c254254940fd9f 2014-06-21 03:11:11 +02:00
remove more domain_deprecated Test: no denials showing up in log collection Test: device boots Bug: 28760354 Change-Id: I089cfcf486464952fcbb52cce9f6152caf662c23 2016-12-10 04:30:39 +01:00			`type vdc, domain;`
Create vdc domain The init.rc one-shot services "defaultcrypto" and "encrypt" call out to the /system/bin/vdc command line to ask vold to perform encryption operations. Create a new domain for these one-shot services. Allow the vdc domain to talk to vold. Change-Id: I73dc2ee4cc265bc16056b27307c254254940fd9f 2014-06-21 03:11:11 +02:00			`type vdc_exec, exec_type, file_type;`

Allow 'vdc' to be invoked with logwrapper. Currently vdc emits logs to stderr, which makes sense for command line invocations, but when exec'ed they're silently dropped unless the caller uses logwrapper. avc: denied { read write } for path="/dev/pts/2" dev="devpts" ino=5 scontext=u:r:vdc:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0 Bug: 25796509 Change-Id: Ib92e0a7f580b1934a9853a83684f95b24bdc355c 2016-02-04 23:18:52 +01:00			`# vdc can be invoked with logwrapper, so let it write to pty`
			`allow vdc devpts:chr_file rw_file_perms;`
Grant vdc access to kmsg Init is no longer calling vdc with logwrapper, so it must take care of logging to kmsg directly. Change-Id: I529f5a95e19c08ef75e0da9a02bae1cb7187eec0 avc: denied { write } for pid=367 comm="vdc" name="kmsg" dev="tmpfs" ino=11056 scontext=u:r:vdc:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 Test: observe vdc logging in kmsg on boot and stderr on normal usage Change-Id: Ie3678509d360f19b95cb03aeea75f29843728203 2017-03-30 01:52:19 +02:00
			`# vdc writes directly to kmsg during the boot process`
			`allow vdc kmsg_device:chr_file w_file_perms;`
Move vdc commands over to Binder. Use nice clean AIDL instead of dirty sockets. avc: denied { call } for pid=603 comm="vdc" scontext=u:r:vdc:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=0 Test: vdc cryptfs init_user0 Bug: 13758960 Change-Id: I8b0e63adad8c4c7e2b5e6aca48386d1b371ea6a5 2017-09-14 21:19:20 +02:00
			`# vdc talks to vold over Binder`
			`binder_use(vdc)`
			`binder_call(vdc, vold)`
			`allow vdc vold_service:service_manager find;`