platform_system_sepolicy/public/vold_prepare_subdirs.te

# SELinux directory creation and labelling for vold-managed directories

type vold_prepare_subdirs, domain;
type vold_prepare_subdirs_exec, system_file_type, exec_type, file_type;
vold_prepare_subdirs sets policy in vold-created dirs. Bug: 25861755 Test: Boot device, observe logs Change-Id: I6c13430d42e9794003eb48e6ca219b874112b900 Merged-In: I6c13430d42e9794003eb48e6ca219b874112b900 (cherry picked from commit 47f3ed09d222ee126cf2fe23b5fe15cd0b64520e) 2017-10-13 23:54:32 +02:00			`# SELinux directory creation and labelling for vold-managed directories`

			`type vold_prepare_subdirs, domain;`
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5 2018-09-27 19:21:37 +02:00			`type vold_prepare_subdirs_exec, system_file_type, exec_type, file_type;`