2012-01-04 18:33:27 +01:00
|
|
|
###########################################
|
2023-11-08 00:19:55 +01:00
|
|
|
# Entries in this file describe the security context associated with a file
|
|
|
|
|
# path. They are used when building the device image, to include the security
|
|
|
|
|
# context within the extended file attributes of the file system. They are also
|
|
|
|
|
# used at runtime when calling restorecon.
|
|
|
|
|
#
|
|
|
|
|
# Entries are merged with other file_contexts from other partitions (e.g.,
|
|
|
|
|
# vendor or odm, see the full list at libselinux/src/android/android.c).
|
|
|
|
|
#
|
|
|
|
|
# The entries are evaluated by the following rules:
|
|
|
|
|
# - Static entries (that is, not using regular expressions) are always
|
|
|
|
|
# evaluated first.
|
|
|
|
|
# - The first matching entry is used.
|
|
|
|
|
# - Entries are evaluated from the bottom to the top.
|
|
|
|
|
#
|
|
|
|
|
# Based on these rules, it is recommended that the less specific entries appear
|
|
|
|
|
# first. For instance:
|
|
|
|
|
# /dev(/.*)? u:object_r:device:s0
|
|
|
|
|
# /dev/block(/.*)? u:object_r:block_device:s0
|
|
|
|
|
# /dev/block/my_dev u:object_r:my_dev:s0
|
|
|
|
|
#
|
|
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
# Root
|
2015-07-24 06:08:32 +02:00
|
|
|
/ u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
|
|
|
|
# Data files
|
2015-07-24 06:08:32 +02:00
|
|
|
/adb_keys u:object_r:adb_keys_file:s0
|
|
|
|
|
/build\.prop u:object_r:rootfs:s0
|
|
|
|
|
/default\.prop u:object_r:rootfs:s0
|
|
|
|
|
/fstab\..* u:object_r:rootfs:s0
|
|
|
|
|
/init\..* u:object_r:rootfs:s0
|
|
|
|
|
/res(/.*)? u:object_r:rootfs:s0
|
|
|
|
|
/selinux_version u:object_r:rootfs:s0
|
|
|
|
|
/ueventd\..* u:object_r:rootfs:s0
|
|
|
|
|
/verity_key u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
|
|
|
|
# Executables
|
2015-07-24 06:08:32 +02:00
|
|
|
/init u:object_r:init_exec:s0
|
|
|
|
|
/sbin(/.*)? u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
2017-03-02 09:02:29 +01:00
|
|
|
# For kernel modules
|
|
|
|
|
/lib(/.*)? u:object_r:rootfs:s0
|
2022-02-10 01:35:54 +01:00
|
|
|
/system_dlkm(/.*)? u:object_r:system_dlkm_file:s0
|
2017-03-02 09:02:29 +01:00
|
|
|
|
2012-12-21 00:26:02 +01:00
|
|
|
# Empty directories
|
2015-07-24 06:08:32 +02:00
|
|
|
/lost\+found u:object_r:rootfs:s0
|
|
|
|
|
/acct u:object_r:cgroup:s0
|
|
|
|
|
/config u:object_r:rootfs:s0
|
2019-12-13 13:30:26 +01:00
|
|
|
/data_mirror u:object_r:mirror_data_file:s0
|
2019-04-16 09:13:22 +02:00
|
|
|
/debug_ramdisk u:object_r:tmpfs:s0
|
2015-07-24 06:08:32 +02:00
|
|
|
/mnt u:object_r:tmpfs:s0
|
|
|
|
|
/proc u:object_r:rootfs:s0
|
2020-10-07 02:16:08 +02:00
|
|
|
/second_stage_resources u:object_r:tmpfs:s0
|
2015-07-24 06:08:32 +02:00
|
|
|
/sys u:object_r:sysfs:s0
|
2018-08-17 09:35:42 +02:00
|
|
|
/apex u:object_r:apex_mnt_dir:s0
|
2023-08-09 09:05:31 +02:00
|
|
|
/bootstrap-apex u:object_r:apex_mnt_dir:s0
|
2023-12-14 23:03:07 +01:00
|
|
|
/tmp u:object_r:shell_data_file:s0
|
2015-07-24 06:08:32 +02:00
|
|
|
|
2021-03-11 20:26:08 +01:00
|
|
|
# Postinstall directories
|
|
|
|
|
/postinstall u:object_r:postinstall_mnt_dir:s0
|
|
|
|
|
/postinstall/apex u:object_r:postinstall_apex_mnt_dir:s0
|
|
|
|
|
|
2020-07-02 15:22:05 +02:00
|
|
|
/apex/(\.(bootstrap|default)-)?apex-info-list.xml u:object_r:apex_info_file:s0
|
2020-05-11 13:49:07 +02:00
|
|
|
|
2015-07-24 06:08:32 +02:00
|
|
|
# Symlinks
|
2017-12-06 21:03:45 +01:00
|
|
|
/bin u:object_r:rootfs:s0
|
2016-11-19 21:13:02 +01:00
|
|
|
/bugreports u:object_r:rootfs:s0
|
2018-09-08 00:05:33 +02:00
|
|
|
/charger u:object_r:rootfs:s0
|
2015-07-24 06:08:32 +02:00
|
|
|
/d u:object_r:rootfs:s0
|
|
|
|
|
/etc u:object_r:rootfs:s0
|
|
|
|
|
/sdcard u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
|
|
|
|
# SELinux policy files
|
2018-01-22 23:31:50 +01:00
|
|
|
/vendor_file_contexts u:object_r:file_contexts_file:s0
|
2017-03-24 23:02:13 +01:00
|
|
|
/plat_file_contexts u:object_r:file_contexts_file:s0
|
2018-12-19 04:51:19 +01:00
|
|
|
/product_file_contexts u:object_r:file_contexts_file:s0
|
2017-03-27 20:39:16 +02:00
|
|
|
/mapping_sepolicy\.cil u:object_r:sepolicy_file:s0
|
|
|
|
|
/plat_sepolicy\.cil u:object_r:sepolicy_file:s0
|
2017-03-24 18:22:14 +01:00
|
|
|
/plat_property_contexts u:object_r:property_contexts_file:s0
|
2018-12-21 04:31:42 +01:00
|
|
|
/product_property_contexts u:object_r:property_contexts_file:s0
|
2018-02-05 10:34:52 +01:00
|
|
|
/vendor_property_contexts u:object_r:property_contexts_file:s0
|
2017-03-27 19:57:07 +02:00
|
|
|
/seapp_contexts u:object_r:seapp_contexts_file:s0
|
2018-02-05 10:34:52 +01:00
|
|
|
/vendor_seapp_contexts u:object_r:seapp_contexts_file:s0
|
2017-03-27 19:57:07 +02:00
|
|
|
/plat_seapp_contexts u:object_r:seapp_contexts_file:s0
|
2017-03-27 20:39:16 +02:00
|
|
|
/sepolicy u:object_r:sepolicy_file:s0
|
2017-03-24 20:24:43 +01:00
|
|
|
/plat_service_contexts u:object_r:service_contexts_file:s0
|
2017-04-08 01:14:43 +02:00
|
|
|
/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
2020-07-25 22:02:29 +02:00
|
|
|
/plat_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0
|
2021-11-05 15:07:57 +01:00
|
|
|
/vendor_service_contexts u:object_r:vendor_service_contexts_file:s0
|
2018-02-05 10:34:52 +01:00
|
|
|
/vendor_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
2017-04-01 02:29:53 +02:00
|
|
|
/vndservice_contexts u:object_r:vndservice_contexts_file:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
##########################
|
|
|
|
|
# Devices
|
|
|
|
|
#
|
|
|
|
|
/dev(/.*)? u:object_r:device:s0
|
2014-06-04 02:01:10 +02:00
|
|
|
/dev/adf[0-9]* u:object_r:graphics_device:s0
|
|
|
|
|
/dev/adf-interface[0-9]*\.[0-9]* u:object_r:graphics_device:s0
|
|
|
|
|
/dev/adf-overlay-engine[0-9]*\.[0-9]* u:object_r:graphics_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/ashmem u:object_r:ashmem_device:s0
|
2019-09-24 23:43:00 +02:00
|
|
|
/dev/ashmem(.*)? u:object_r:ashmem_libcutils_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/audio.* u:object_r:audio_device:s0
|
|
|
|
|
/dev/binder u:object_r:binder_device:s0
|
|
|
|
|
/dev/block(/.*)? u:object_r:block_device:s0
|
2023-01-16 04:35:34 +01:00
|
|
|
/dev/block/by-name/zoned_device u:object_r:zoned_block_device:s0
|
2014-09-30 17:37:51 +02:00
|
|
|
/dev/block/dm-[0-9]+ u:object_r:dm_device:s0
|
2023-02-14 01:30:40 +01:00
|
|
|
/dev/block/ublkb[0-9]+ u:object_r:ublk_block_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/block/loop[0-9]* u:object_r:loop_device:s0
|
2021-04-12 14:44:43 +02:00
|
|
|
/dev/block/vd[a-z][0-9]* u:object_r:vd_device:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
/dev/block/vold/.+ u:object_r:vold_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/block/ram[0-9]* u:object_r:ram_device:s0
|
2015-08-25 21:06:39 +02:00
|
|
|
/dev/block/zram[0-9]* u:object_r:ram_device:s0
|
2019-08-28 23:08:50 +02:00
|
|
|
/dev/boringssl/selftest(/.*)? u:object_r:boringssl_self_test_marker:s0
|
2013-03-27 11:30:25 +01:00
|
|
|
/dev/bus/usb(.*)? u:object_r:usb_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/console u:object_r:console_device:s0
|
2018-11-06 00:03:16 +01:00
|
|
|
/dev/cpu_variant:.* u:object_r:dev_cpu_variant:s0
|
2020-12-15 07:57:49 +01:00
|
|
|
/dev/dma_heap(/.*)? u:object_r:dmabuf_heap_device:s0
|
2020-09-11 00:43:07 +02:00
|
|
|
/dev/dma_heap/system u:object_r:dmabuf_system_heap_device:s0
|
2020-11-26 03:23:23 +01:00
|
|
|
/dev/dma_heap/system-uncached u:object_r:dmabuf_system_heap_device:s0
|
2021-04-28 20:59:43 +02:00
|
|
|
/dev/dma_heap/system-secure(.*) u:object_r:dmabuf_system_secure_heap_device:s0
|
2020-11-13 09:45:59 +01:00
|
|
|
/dev/dm-user(/.*)? u:object_r:dm_user_device:s0
|
2023-02-14 01:30:40 +01:00
|
|
|
/dev/ublk-control u:object_r:ublk_control_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/device-mapper u:object_r:dm_device:s0
|
2012-04-03 21:30:28 +02:00
|
|
|
/dev/eac u:object_r:audio_device:s0
|
2016-11-08 00:11:39 +01:00
|
|
|
/dev/event-log-tags u:object_r:runtime_event_log_tags_file:s0
|
2019-01-11 02:10:31 +01:00
|
|
|
/dev/cgroup_info(/.*)? u:object_r:cgroup_rc_file:s0
|
2013-11-04 15:47:29 +01:00
|
|
|
/dev/fscklogs(/.*)? u:object_r:fscklogs:s0
|
2012-05-31 15:44:51 +02:00
|
|
|
/dev/fuse u:object_r:fuse_device:s0
|
2020-03-16 23:35:49 +01:00
|
|
|
/dev/gnss[0-9]+ u:object_r:gnss_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/graphics(/.*)? u:object_r:graphics_device:s0
|
2023-12-01 00:28:04 +01:00
|
|
|
/dev/hidraw[0-9]+ u:object_r:hidraw_device:s0
|
2013-10-03 22:35:56 +02:00
|
|
|
/dev/hw_random u:object_r:hw_random_device:s0
|
2016-05-24 15:15:23 +02:00
|
|
|
/dev/hwbinder u:object_r:hwbinder_device:s0
|
2017-09-26 21:58:29 +02:00
|
|
|
/dev/input(/.*)? u:object_r:input_device:s0
|
2013-01-30 19:17:14 +01:00
|
|
|
/dev/iio:device[0-9]+ u:object_r:iio_device:s0
|
2012-06-20 03:46:16 +02:00
|
|
|
/dev/ion u:object_r:ion_device:s0
|
2017-01-09 23:57:03 +01:00
|
|
|
/dev/keychord u:object_r:keychord_device:s0
|
2017-03-26 05:38:17 +02:00
|
|
|
/dev/loop-control u:object_r:loop_control_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/modem.* u:object_r:radio_device:s0
|
2012-01-06 16:25:53 +01:00
|
|
|
/dev/mtp_usb u:object_r:mtp_device:s0
|
2014-12-15 21:01:35 +01:00
|
|
|
/dev/pmsg0 u:object_r:pmsg_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/pn544 u:object_r:nfc_device:s0
|
2016-12-05 00:11:29 +01:00
|
|
|
/dev/port u:object_r:port_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/ptmx u:object_r:ptmx_device:s0
|
2014-01-16 14:47:34 +01:00
|
|
|
/dev/pvrsrvkm u:object_r:gpu_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/kmsg u:object_r:kmsg_device:s0
|
2017-03-28 22:09:37 +02:00
|
|
|
/dev/kmsg_debug u:object_r:kmsg_debug_device:s0
|
2021-03-29 19:19:12 +02:00
|
|
|
/dev/kvm u:object_r:kvm_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/null u:object_r:null_device:s0
|
|
|
|
|
/dev/nvhdcp1 u:object_r:video_device:s0
|
|
|
|
|
/dev/random u:object_r:random_device:s0
|
2012-07-11 20:21:05 +02:00
|
|
|
/dev/rpmsg-omx[0-9] u:object_r:rpmsg_device:s0
|
|
|
|
|
/dev/rproc_user u:object_r:rpmsg_device:s0
|
2015-05-21 19:03:16 +02:00
|
|
|
/dev/rtc[0-9] u:object_r:rtc_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/snd(/.*)? u:object_r:audio_device:s0
|
2013-12-02 15:02:22 +01:00
|
|
|
/dev/socket(/.*)? u:object_r:socket_device:s0
|
2012-11-16 15:06:47 +01:00
|
|
|
/dev/socket/adbd u:object_r:adbd_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/socket/dnsproxyd u:object_r:dnsproxyd_socket:s0
|
2013-12-14 07:19:45 +01:00
|
|
|
/dev/socket/dumpstate u:object_r:dumpstate_socket:s0
|
2014-05-01 20:12:10 +02:00
|
|
|
/dev/socket/fwmarkd u:object_r:fwmarkd_socket:s0
|
2013-12-06 01:55:34 +01:00
|
|
|
/dev/socket/lmkd u:object_r:lmkd_socket:s0
|
2013-11-13 00:34:52 +01:00
|
|
|
/dev/socket/logd u:object_r:logd_socket:s0
|
|
|
|
|
/dev/socket/logdr u:object_r:logdr_socket:s0
|
|
|
|
|
/dev/socket/logdw u:object_r:logdw_socket:s0
|
2018-04-20 20:07:22 +02:00
|
|
|
/dev/socket/statsdw u:object_r:statsdw_socket:s0
|
2013-09-19 21:09:38 +02:00
|
|
|
/dev/socket/mdns u:object_r:mdns_socket:s0
|
2014-02-24 19:04:49 +01:00
|
|
|
/dev/socket/mdnsd u:object_r:mdnsd_socket:s0
|
2024-01-16 15:19:28 +01:00
|
|
|
/dev/socket/ot-daemon(/.*)? u:object_r:ot_daemon_socket:s0
|
2017-05-01 22:01:44 +02:00
|
|
|
/dev/socket/pdx/system/buffer_hub u:object_r:pdx_bufferhub_dir:s0
|
|
|
|
|
/dev/socket/pdx/system/buffer_hub/client u:object_r:pdx_bufferhub_client_endpoint_socket:s0
|
|
|
|
|
/dev/socket/pdx/system/performance u:object_r:pdx_performance_dir:s0
|
|
|
|
|
/dev/socket/pdx/system/performance/client u:object_r:pdx_performance_client_endpoint_socket:s0
|
|
|
|
|
/dev/socket/pdx/system/vr/display u:object_r:pdx_display_dir:s0
|
|
|
|
|
/dev/socket/pdx/system/vr/display/client u:object_r:pdx_display_client_endpoint_socket:s0
|
|
|
|
|
/dev/socket/pdx/system/vr/display/manager u:object_r:pdx_display_manager_endpoint_socket:s0
|
|
|
|
|
/dev/socket/pdx/system/vr/display/screenshot u:object_r:pdx_display_screenshot_endpoint_socket:s0
|
|
|
|
|
/dev/socket/pdx/system/vr/display/vsync u:object_r:pdx_display_vsync_endpoint_socket:s0
|
2022-09-16 16:31:39 +02:00
|
|
|
/dev/socket/prng_seeder u:object_r:prng_seeder_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/socket/property_service u:object_r:property_socket:s0
|
2023-01-21 00:09:04 +01:00
|
|
|
/dev/socket/property_service_for_system u:object_r:property_socket:s0
|
2018-05-29 19:54:16 +02:00
|
|
|
/dev/socket/recovery u:object_r:recovery_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/socket/rild u:object_r:rild_socket:s0
|
|
|
|
|
/dev/socket/rild-debug u:object_r:rild_debug_socket:s0
|
2020-10-20 07:11:29 +02:00
|
|
|
/dev/socket/snapuserd u:object_r:snapuserd_socket:s0
|
2021-07-27 00:03:11 +02:00
|
|
|
/dev/socket/snapuserd_proxy u:object_r:snapuserd_proxy_socket:s0
|
2016-10-19 23:39:30 +02:00
|
|
|
/dev/socket/tombstoned_crash u:object_r:tombstoned_crash_socket:s0
|
2017-05-15 19:39:16 +02:00
|
|
|
/dev/socket/tombstoned_java_trace u:object_r:tombstoned_java_trace_socket:s0
|
2016-10-19 23:39:30 +02:00
|
|
|
/dev/socket/tombstoned_intercept u:object_r:tombstoned_intercept_socket:s0
|
2017-12-21 03:51:15 +01:00
|
|
|
/dev/socket/traced_consumer u:object_r:traced_consumer_socket:s0
|
2020-01-22 20:16:13 +01:00
|
|
|
/dev/socket/traced_perf u:object_r:traced_perf_socket:s0
|
|
|
|
|
/dev/socket/traced_producer u:object_r:traced_producer_socket:s0
|
2018-10-15 19:02:02 +02:00
|
|
|
/dev/socket/heapprofd u:object_r:heapprofd_socket:s0
|
2016-02-26 19:30:12 +01:00
|
|
|
/dev/socket/uncrypt u:object_r:uncrypt_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/socket/wpa_eth[0-9] u:object_r:wpa_socket:s0
|
|
|
|
|
/dev/socket/wpa_wlan[0-9] u:object_r:wpa_socket:s0
|
|
|
|
|
/dev/socket/zygote u:object_r:zygote_socket:s0
|
2014-05-23 01:48:20 +02:00
|
|
|
/dev/socket/zygote_secondary u:object_r:zygote_socket:s0
|
2019-02-23 00:42:25 +01:00
|
|
|
/dev/socket/usap_pool_primary u:object_r:zygote_socket:s0
|
|
|
|
|
/dev/socket/usap_pool_secondary u:object_r:zygote_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/spdif_out.* u:object_r:audio_device:s0
|
2022-03-06 09:47:06 +01:00
|
|
|
/dev/sys/block/by-name/rootdisk(/.*)? u:object_r:rootdisk_sysdev:s0
|
2021-02-23 08:14:53 +01:00
|
|
|
/dev/sys/block/by-name/userdata(/.*)? u:object_r:userdata_sysdev:s0
|
2021-02-19 00:45:02 +01:00
|
|
|
/dev/sys/fs/by-name/userdata(/.*)? u:object_r:userdata_sysdev:s0
|
2013-04-05 20:22:27 +02:00
|
|
|
/dev/tty u:object_r:owntty_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/tty[0-9]* u:object_r:tty_device:s0
|
|
|
|
|
/dev/ttyS[0-9]* u:object_r:serial_device:s0
|
2019-11-14 18:32:32 +01:00
|
|
|
/dev/ttyUSB[0-9]* u:object_r:usb_serial_device:s0
|
|
|
|
|
/dev/ttyACM[0-9]* u:object_r:usb_serial_device:s0
|
2013-01-07 15:21:18 +01:00
|
|
|
/dev/tun u:object_r:tun_device:s0
|
|
|
|
|
/dev/uhid u:object_r:uhid_device:s0
|
2013-10-23 19:50:19 +02:00
|
|
|
/dev/uinput u:object_r:uhid_device:s0
|
2014-03-26 20:37:54 +01:00
|
|
|
/dev/uio[0-9]* u:object_r:uio_device:s0
|
2016-11-19 21:52:54 +01:00
|
|
|
/dev/urandom u:object_r:random_device:s0
|
2013-01-30 19:17:14 +01:00
|
|
|
/dev/usb_accessory u:object_r:usbaccessory_device:s0
|
2017-12-23 02:17:06 +01:00
|
|
|
/dev/v4l-touch[0-9]* u:object_r:input_device:s0
|
2023-08-01 04:00:49 +02:00
|
|
|
/dev/vfio(/.*)? u:object_r:vfio_device:s0
|
2021-03-29 19:19:12 +02:00
|
|
|
/dev/vhost-vsock u:object_r:kvm_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/video[0-9]* u:object_r:video_device:s0
|
2017-03-22 00:01:52 +01:00
|
|
|
/dev/vndbinder u:object_r:vndbinder_device:s0
|
2012-12-03 12:07:45 +01:00
|
|
|
/dev/watchdog u:object_r:watchdog_device:s0
|
2012-07-19 20:07:04 +02:00
|
|
|
/dev/xt_qtaguid u:object_r:qtaguid_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/zero u:object_r:zero_device:s0
|
2013-03-01 02:33:16 +01:00
|
|
|
/dev/__properties__ u:object_r:properties_device:s0
|
2023-08-16 01:41:17 +02:00
|
|
|
/dev/__properties__/appcompat_override u:object_r:properties_device:s0
|
2017-11-16 23:25:02 +01:00
|
|
|
/dev/__properties__/property_info u:object_r:property_info:s0
|
2023-08-16 01:41:17 +02:00
|
|
|
/dev/__properties__/appcompat_override/property_info u:object_r:property_info:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
#############################
|
2019-11-22 06:56:10 +01:00
|
|
|
# Linker configuration
|
|
|
|
|
#
|
|
|
|
|
/linkerconfig(/.*)? u:object_r:linkerconfig_file:s0
|
2021-12-03 15:21:54 +01:00
|
|
|
|
2019-11-22 06:56:10 +01:00
|
|
|
#############################
|
2012-01-04 18:33:27 +01:00
|
|
|
# System files
|
|
|
|
|
#
|
|
|
|
|
/system(/.*)? u:object_r:system_file:s0
|
2019-07-17 16:48:30 +02:00
|
|
|
/system/apex/com.android.art u:object_r:art_apex_dir:s0
|
2018-08-12 00:34:49 +02:00
|
|
|
/system/lib(64)?(/.*)? u:object_r:system_lib_file:s0
|
2019-03-14 18:45:33 +01:00
|
|
|
/system/lib(64)?/bootstrap(/.*)? u:object_r:system_bootstrap_lib_file:s0
|
2021-03-16 19:30:36 +01:00
|
|
|
/system/bin/mm_events u:object_r:mm_events_exec:s0
|
2015-06-24 08:24:17 +02:00
|
|
|
/system/bin/atrace u:object_r:atrace_exec:s0
|
2019-04-09 19:57:13 +02:00
|
|
|
/system/bin/auditctl u:object_r:auditctl_exec:s0
|
2018-12-12 18:06:05 +01:00
|
|
|
/system/bin/bcc u:object_r:rs_exec:s0
|
2018-01-19 22:00:42 +01:00
|
|
|
/system/bin/blank_screen u:object_r:blank_screen_exec:s0
|
2019-08-28 23:08:50 +02:00
|
|
|
/system/bin/boringssl_self_test(32|64) u:object_r:boringssl_self_test_exec:s0
|
2022-09-16 16:31:39 +02:00
|
|
|
/system/bin/prng_seeder u:object_r:prng_seeder_exec:s0
|
2018-09-08 00:05:33 +02:00
|
|
|
/system/bin/charger u:object_r:charger_exec:s0
|
2017-06-07 02:27:44 +02:00
|
|
|
/system/bin/e2fsdroid u:object_r:e2fs_exec:s0
|
|
|
|
|
/system/bin/mke2fs u:object_r:e2fs_exec:s0
|
2014-09-23 15:11:30 +02:00
|
|
|
/system/bin/e2fsck -- u:object_r:fsck_exec:s0
|
2021-07-29 23:29:47 +02:00
|
|
|
/system/bin/extra_free_kbytes\.sh u:object_r:extra_free_kbytes_exec:s0
|
2018-05-22 15:53:42 +02:00
|
|
|
/system/bin/fsck\.exfat -- u:object_r:fsck_exec:s0
|
2014-10-20 19:36:49 +02:00
|
|
|
/system/bin/fsck\.f2fs -- u:object_r:fsck_exec:s0
|
2018-09-08 00:05:33 +02:00
|
|
|
/system/bin/init u:object_r:init_exec:s0
|
2019-03-15 19:15:31 +01:00
|
|
|
# TODO(/123600489): merge mini-keyctl into toybox
|
|
|
|
|
/system/bin/mini-keyctl -- u:object_r:toolbox_exec:s0
|
|
|
|
|
/system/bin/fsverity_init u:object_r:fsverity_init_exec:s0
|
2017-11-29 04:39:10 +01:00
|
|
|
/system/bin/sload_f2fs -- u:object_r:e2fs_exec:s0
|
2017-11-27 19:13:33 +01:00
|
|
|
/system/bin/make_f2fs -- u:object_r:e2fs_exec:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
/system/bin/fsck_msdos -- u:object_r:fsck_exec:s0
|
2018-10-11 19:49:59 +02:00
|
|
|
/system/bin/tcpdump -- u:object_r:tcpdump_exec:s0
|
2016-07-22 08:18:47 +02:00
|
|
|
/system/bin/tune2fs -- u:object_r:fsck_exec:s0
|
2020-02-25 17:37:35 +01:00
|
|
|
/system/bin/resize2fs -- u:object_r:fsck_exec:s0
|
2014-09-23 15:11:30 +02:00
|
|
|
/system/bin/toolbox -- u:object_r:toolbox_exec:s0
|
2014-12-18 01:03:01 +01:00
|
|
|
/system/bin/toybox -- u:object_r:toolbox_exec:s0
|
2018-12-12 18:06:05 +01:00
|
|
|
/system/bin/ld\.mc u:object_r:rs_exec:s0
|
2014-09-04 14:44:49 +02:00
|
|
|
/system/bin/logcat -- u:object_r:logcat_exec:s0
|
2017-04-03 21:38:30 +02:00
|
|
|
/system/bin/logcatd -- u:object_r:logcat_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/sh -- u:object_r:shell_exec:s0
|
2012-11-13 19:00:05 +01:00
|
|
|
/system/bin/run-as -- u:object_r:runas_exec:s0
|
2013-12-11 21:17:53 +01:00
|
|
|
/system/bin/bootanimation u:object_r:bootanim_exec:s0
|
2016-01-26 01:23:10 +01:00
|
|
|
/system/bin/bootstat u:object_r:bootstat_exec:s0
|
2014-05-14 18:13:24 +02:00
|
|
|
/system/bin/app_process32 u:object_r:zygote_exec:s0
|
2014-04-04 18:45:57 +02:00
|
|
|
/system/bin/app_process64 u:object_r:zygote_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/servicemanager u:object_r:servicemanager_exec:s0
|
|
|
|
|
/system/bin/surfaceflinger u:object_r:surfaceflinger_exec:s0
|
2018-11-01 21:47:51 +01:00
|
|
|
/system/bin/gpuservice u:object_r:gpuservice_exec:s0
|
2017-02-10 00:15:11 +01:00
|
|
|
/system/bin/bufferhubd u:object_r:bufferhubd_exec:s0
|
|
|
|
|
/system/bin/performanced u:object_r:performanced_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/drmserver u:object_r:drmserver_exec:s0
|
2023-05-15 10:31:47 +02:00
|
|
|
/system/bin/drmserver32 u:object_r:drmserver_exec:s0
|
|
|
|
|
/system/bin/drmserver64 u:object_r:drmserver_exec:s0
|
2013-12-14 07:19:45 +01:00
|
|
|
/system/bin/dumpstate u:object_r:dumpstate_exec:s0
|
2016-11-21 08:23:04 +01:00
|
|
|
/system/bin/incident u:object_r:incident_exec:s0
|
|
|
|
|
/system/bin/incidentd u:object_r:incidentd_exec:s0
|
2018-01-22 23:00:46 +01:00
|
|
|
/system/bin/incident_helper u:object_r:incident_helper_exec:s0
|
2018-11-09 22:09:24 +01:00
|
|
|
/system/bin/iw u:object_r:iw_exec:s0
|
2017-04-15 04:06:56 +02:00
|
|
|
/system/bin/netutils-wrapper-1\.0 u:object_r:netutils_wrapper_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/vold u:object_r:vold_exec:s0
|
|
|
|
|
/system/bin/netd u:object_r:netd_exec:s0
|
2016-05-20 04:31:20 +02:00
|
|
|
/system/bin/wificond u:object_r:wificond_exec:s0
|
2015-09-09 19:48:04 +02:00
|
|
|
/system/bin/audioserver u:object_r:audioserver_exec:s0
|
2016-02-12 18:05:42 +01:00
|
|
|
/system/bin/mediadrmserver u:object_r:mediadrmserver_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/mediaserver u:object_r:mediaserver_exec:s0
|
2022-06-22 03:20:58 +02:00
|
|
|
/system/bin/mediaserver32 u:object_r:mediaserver_exec:s0
|
|
|
|
|
/system/bin/mediaserver64 u:object_r:mediaserver_exec:s0
|
2017-01-24 21:53:45 +01:00
|
|
|
/system/bin/mediametrics u:object_r:mediametrics_exec:s0
|
2015-12-04 01:10:05 +01:00
|
|
|
/system/bin/cameraserver u:object_r:cameraserver_exec:s0
|
2015-09-22 19:56:03 +02:00
|
|
|
/system/bin/mediaextractor u:object_r:mediaextractor_exec:s0
|
2018-09-20 21:07:44 +02:00
|
|
|
/system/bin/mediaswcodec u:object_r:mediaswcodec_exec:s0
|
2019-11-28 03:10:01 +01:00
|
|
|
/system/bin/mediatranscoding u:object_r:mediatranscoding_exec:s0
|
2020-09-12 02:50:45 +02:00
|
|
|
/system/bin/mediatuner u:object_r:mediatuner_exec:s0
|
2014-02-24 19:04:49 +01:00
|
|
|
/system/bin/mdnsd u:object_r:mdnsd_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/installd u:object_r:installd_exec:s0
|
2016-03-30 00:08:20 +02:00
|
|
|
/system/bin/otapreopt_chroot u:object_r:otapreopt_chroot_exec:s0
|
2016-07-09 20:57:13 +02:00
|
|
|
/system/bin/otapreopt_slot u:object_r:otapreopt_slot_exec:s0
|
2020-01-17 22:47:53 +01:00
|
|
|
/system/bin/credstore u:object_r:credstore_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/keystore u:object_r:keystore_exec:s0
|
2020-08-10 23:40:20 +02:00
|
|
|
/system/bin/keystore2 u:object_r:keystore_exec:s0
|
2015-05-13 00:16:06 +02:00
|
|
|
/system/bin/fingerprintd u:object_r:fingerprintd_exec:s0
|
2015-04-04 01:46:33 +02:00
|
|
|
/system/bin/gatekeeperd u:object_r:gatekeeperd_exec:s0
|
2016-10-19 23:39:30 +02:00
|
|
|
/system/bin/tombstoned u:object_r:tombstoned_exec:s0
|
2016-03-16 16:11:49 +01:00
|
|
|
/system/bin/recovery-persist u:object_r:recovery_persist_exec:s0
|
|
|
|
|
/system/bin/recovery-refresh u:object_r:recovery_refresh_exec:s0
|
2012-05-31 15:44:51 +02:00
|
|
|
/system/bin/sdcard u:object_r:sdcardd_exec:s0
|
2019-09-21 00:14:23 +02:00
|
|
|
/system/bin/snapshotctl u:object_r:snapshotctl_exec:s0
|
2021-11-02 15:08:00 +01:00
|
|
|
/system/bin/remount u:object_r:remount_exec:s0
|
2012-08-15 12:25:14 +02:00
|
|
|
/system/bin/dhcpcd u:object_r:dhcp_exec:s0
|
2018-10-24 15:50:22 +02:00
|
|
|
/system/bin/dhcpcd-6\.8\.2 u:object_r:dhcp_exec:s0
|
2022-01-28 19:48:27 +01:00
|
|
|
/system/bin/dmesgd u:object_r:dmesgd_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/xbin/su u:object_r:su_exec:s0
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
/system/bin/dnsmasq u:object_r:dnsmasq_exec:s0
|
2018-09-25 01:12:23 +02:00
|
|
|
/system/bin/linker(64)? u:object_r:system_linker_exec:s0
|
2019-07-08 12:02:05 +02:00
|
|
|
/system/bin/linkerconfig u:object_r:linkerconfig_exec:s0
|
2019-01-16 15:35:34 +01:00
|
|
|
/system/bin/bootstrap/linker(64)? u:object_r:system_linker_exec:s0
|
2020-11-30 06:47:03 +01:00
|
|
|
/system/bin/bootstrap/linkerconfig u:object_r:linkerconfig_exec:s0
|
2018-02-20 20:02:39 +01:00
|
|
|
/system/bin/llkd u:object_r:llkd_exec:s0
|
2013-12-06 01:55:34 +01:00
|
|
|
/system/bin/lmkd u:object_r:lmkd_exec:s0
|
2017-12-03 23:23:16 +01:00
|
|
|
/system/bin/usbd u:object_r:usbd_exec:s0
|
2013-12-15 21:50:00 +01:00
|
|
|
/system/bin/inputflinger u:object_r:inputflinger_exec:s0
|
2013-11-13 00:34:52 +01:00
|
|
|
/system/bin/logd u:object_r:logd_exec:s0
|
2019-03-14 23:45:03 +01:00
|
|
|
/system/bin/lpdumpd u:object_r:lpdumpd_exec:s0
|
2018-11-15 14:04:13 +01:00
|
|
|
/system/bin/rss_hwm_reset u:object_r:rss_hwm_reset_exec:s0
|
2018-01-24 17:07:09 +01:00
|
|
|
/system/bin/perfetto u:object_r:perfetto_exec:s0
|
2022-01-20 00:19:20 +01:00
|
|
|
/system/bin/mtectrl u:object_r:mtectrl_exec:s0
|
2017-12-21 03:51:15 +01:00
|
|
|
/system/bin/traced u:object_r:traced_exec:s0
|
2020-01-22 20:16:13 +01:00
|
|
|
/system/bin/traced_perf u:object_r:traced_perf_exec:s0
|
2017-12-21 03:51:15 +01:00
|
|
|
/system/bin/traced_probes u:object_r:traced_probes_exec:s0
|
2018-10-15 19:02:02 +02:00
|
|
|
/system/bin/heapprofd u:object_r:heapprofd_exec:s0
|
2014-02-19 22:33:32 +01:00
|
|
|
/system/bin/uncrypt u:object_r:uncrypt_exec:s0
|
2015-12-05 02:48:50 +01:00
|
|
|
/system/bin/update_verifier u:object_r:update_verifier_exec:s0
|
2014-06-17 17:49:17 +02:00
|
|
|
/system/bin/logwrapper u:object_r:system_file:s0
|
2014-06-21 03:11:11 +02:00
|
|
|
/system/bin/vdc u:object_r:vdc_exec:s0
|
2018-10-24 15:50:22 +02:00
|
|
|
/system/bin/cppreopts\.sh u:object_r:cppreopts_exec:s0
|
|
|
|
|
/system/bin/preloads_copy\.sh u:object_r:preloads_copy_exec:s0
|
2016-06-23 00:47:09 +02:00
|
|
|
/system/bin/preopt2cachename u:object_r:preopt2cachename_exec:s0
|
2019-01-11 17:13:01 +01:00
|
|
|
/system/bin/viewcompiler u:object_r:viewcompiler_exec:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
/system/bin/sgdisk u:object_r:sgdisk_exec:s0
|
|
|
|
|
/system/bin/blkid u:object_r:blkid_exec:s0
|
2018-10-26 05:09:55 +02:00
|
|
|
/system/bin/flags_health_check -- u:object_r:flags_health_check_exec:s0
|
2018-06-15 08:08:19 +02:00
|
|
|
/system/bin/idmap2(d)? u:object_r:idmap_exec:s0
|
2015-10-05 23:04:39 +02:00
|
|
|
/system/bin/update_engine u:object_r:update_engine_exec:s0
|
2020-06-18 06:43:23 +02:00
|
|
|
/system/bin/profcollectd u:object_r:profcollectd_exec:s0
|
2020-08-31 19:54:01 +02:00
|
|
|
/system/bin/profcollectctl u:object_r:profcollectd_exec:s0
|
2016-06-18 00:05:10 +02:00
|
|
|
/system/bin/storaged u:object_r:storaged_exec:s0
|
2017-02-10 00:15:11 +01:00
|
|
|
/system/bin/virtual_touchpad u:object_r:virtual_touchpad_exec:s0
|
2023-09-29 16:15:23 +02:00
|
|
|
/system/bin/virtual_camera u:object_r:virtual_camera_exec:s0
|
2018-10-21 03:33:41 +02:00
|
|
|
/system/bin/hw/android\.frameworks\.bufferhub@1\.0-service u:object_r:fwk_bufferhub_exec:s0
|
2022-05-13 22:05:44 +02:00
|
|
|
/system/bin/hw/android\.system\.suspend-service u:object_r:system_suspend_exec:s0
|
2019-01-11 02:10:31 +01:00
|
|
|
/system/etc/cgroups\.json u:object_r:cgroup_desc_file:s0
|
2020-11-21 03:57:36 +01:00
|
|
|
/system/etc/task_profiles/cgroups_[0-9]+\.json u:object_r:cgroup_desc_api_file:s0
|
2019-01-10 22:59:37 +01:00
|
|
|
/system/etc/event-log-tags u:object_r:system_event_log_tags_file:s0
|
2023-07-21 07:29:24 +02:00
|
|
|
/system/etc/font_fallback.xml u:object_r:system_font_fallback_file:s0
|
2019-07-15 22:33:48 +02:00
|
|
|
/system/etc/group u:object_r:system_group_file:s0
|
2018-08-12 00:34:49 +02:00
|
|
|
/system/etc/ld\.config.* u:object_r:system_linker_config_file:s0
|
2019-07-15 22:33:48 +02:00
|
|
|
/system/etc/passwd u:object_r:system_passwd_file:s0
|
2018-08-12 00:34:49 +02:00
|
|
|
/system/etc/seccomp_policy(/.*)? u:object_r:system_seccomp_policy_file:s0
|
|
|
|
|
/system/etc/security/cacerts(/.*)? u:object_r:system_security_cacerts_file:s0
|
2023-10-06 04:59:57 +02:00
|
|
|
/system/etc/selinux/mapping/[0-9]+\.[0-9]+(\.compat)?\.cil u:object_r:sepolicy_file:s0
|
2017-04-10 21:27:18 +02:00
|
|
|
/system/etc/selinux/plat_mac_permissions\.xml u:object_r:mac_perms_file:s0
|
2017-03-24 18:22:14 +01:00
|
|
|
/system/etc/selinux/plat_property_contexts u:object_r:property_contexts_file:s0
|
2017-03-24 20:24:43 +01:00
|
|
|
/system/etc/selinux/plat_service_contexts u:object_r:service_contexts_file:s0
|
2017-04-08 01:14:43 +02:00
|
|
|
/system/etc/selinux/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
2020-07-25 22:02:29 +02:00
|
|
|
/system/etc/selinux/plat_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0
|
2017-03-24 23:02:13 +01:00
|
|
|
/system/etc/selinux/plat_file_contexts u:object_r:file_contexts_file:s0
|
2017-03-27 19:57:07 +02:00
|
|
|
/system/etc/selinux/plat_seapp_contexts u:object_r:seapp_contexts_file:s0
|
2018-10-24 15:50:22 +02:00
|
|
|
/system/etc/selinux/plat_sepolicy\.cil u:object_r:sepolicy_file:s0
|
2017-04-10 21:27:18 +02:00
|
|
|
/system/etc/selinux/plat_and_mapping_sepolicy\.cil\.sha256 u:object_r:sepolicy_file:s0
|
2019-01-11 02:10:31 +01:00
|
|
|
/system/etc/task_profiles\.json u:object_r:task_profiles_file:s0
|
2020-11-21 03:57:36 +01:00
|
|
|
/system/etc/task_profiles/task_profiles_[0-9]+\.json u:object_r:task_profiles_api_file:s0
|
2018-09-27 17:45:16 +02:00
|
|
|
/system/usr/share/zoneinfo(/.*)? u:object_r:system_zoneinfo_file:s0
|
2017-07-31 12:38:28 +02:00
|
|
|
/system/bin/adbd u:object_r:adbd_exec:s0
|
2017-10-13 23:54:32 +02:00
|
|
|
/system/bin/vold_prepare_subdirs u:object_r:vold_prepare_subdirs_exec:s0
|
2017-12-19 00:14:33 +01:00
|
|
|
/system/bin/stats u:object_r:stats_exec:s0
|
|
|
|
|
/system/bin/statsd u:object_r:statsd_exec:s0
|
2018-01-03 00:31:18 +01:00
|
|
|
/system/bin/bpfloader u:object_r:bpfloader_exec:s0
|
2023-10-09 20:45:16 +02:00
|
|
|
/system/bin/netbpfload u:object_r:bpfloader_exec:s0
|
2018-08-02 00:48:20 +02:00
|
|
|
/system/bin/watchdogd u:object_r:watchdogd_exec:s0
|
2018-08-17 09:35:42 +02:00
|
|
|
/system/bin/apexd u:object_r:apexd_exec:s0
|
2019-01-14 23:38:17 +01:00
|
|
|
/system/bin/gsid u:object_r:gsid_exec:s0
|
2020-01-10 20:02:43 +01:00
|
|
|
/system/bin/simpleperf u:object_r:simpleperf_exec:s0
|
2019-01-11 00:34:08 +01:00
|
|
|
/system/bin/simpleperf_app_runner u:object_r:simpleperf_app_runner_exec:s0
|
2022-09-02 03:11:56 +02:00
|
|
|
/system/bin/migrate_legacy_obb_data u:object_r:migrate_legacy_obb_data_exec:s0
|
2023-04-08 02:13:22 +02:00
|
|
|
/system/bin/android\.frameworks\.automotive\.display@1\.0-service u:object_r:automotive_display_service_exec:s0
|
2020-10-20 07:11:29 +02:00
|
|
|
/system/bin/snapuserd u:object_r:snapuserd_exec:s0
|
2020-11-27 12:23:54 +01:00
|
|
|
/system/bin/odsign u:object_r:odsign_exec:s0
|
2021-06-01 22:13:02 +02:00
|
|
|
/system/bin/vehicle_binding_util u:object_r:vehicle_binding_util_exec:s0
|
2023-04-08 02:12:21 +02:00
|
|
|
/system/bin/cardisplayproxyd u:object_r:automotive_display_service_exec:s0
|
2022-02-10 15:09:02 +01:00
|
|
|
/system/bin/evsmanagerd u:object_r:evsmanagerd_exec:s0
|
|
|
|
|
/system/bin/android\.automotive\.evs\.manager@1\.[0-9]+ u:object_r:evsmanagerd_exec:s0
|
2023-09-25 20:42:03 +02:00
|
|
|
/system/bin/uprobestats u:object_r:uprobestats_exec:s0
|
2014-07-03 01:18:16 +02:00
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
#############################
|
2013-03-20 20:03:04 +01:00
|
|
|
# Vendor files
|
|
|
|
|
#
|
2017-04-02 02:17:12 +02:00
|
|
|
/(vendor|system/vendor)(/.*)? u:object_r:vendor_file:s0
|
2017-04-13 22:06:00 +02:00
|
|
|
/(vendor|system/vendor)/bin/sh u:object_r:vendor_shell_exec:s0
|
2017-04-13 00:19:12 +02:00
|
|
|
/(vendor|system/vendor)/bin/toybox_vendor u:object_r:vendor_toolbox_exec:s0
|
2018-01-11 21:53:09 +01:00
|
|
|
/(vendor|system/vendor)/bin/toolbox u:object_r:vendor_toolbox_exec:s0
|
2017-04-02 02:17:12 +02:00
|
|
|
/(vendor|system/vendor)/etc(/.*)? u:object_r:vendor_configs_file:s0
|
2019-02-20 00:02:14 +01:00
|
|
|
/(vendor|system/vendor)/etc/cgroups\.json u:object_r:vendor_cgroup_desc_file:s0
|
|
|
|
|
/(vendor|system/vendor)/etc/task_profiles\.json u:object_r:vendor_task_profiles_file:s0
|
2023-11-15 09:59:30 +01:00
|
|
|
/(vendor|system/vendor)/etc/avf/microdroid(/.*)? u:object_r:vendor_microdroid_file:s0
|
2017-04-02 02:17:12 +02:00
|
|
|
|
|
|
|
|
/(vendor|system/vendor)/lib(64)?/egl(/.*)? u:object_r:same_process_hal_file:s0
|
|
|
|
|
|
2017-04-10 06:37:40 +02:00
|
|
|
/(vendor|system/vendor)/lib(64)?/vndk-sp(/.*)? u:object_r:vndk_sp_file:s0
|
2017-04-07 14:16:19 +02:00
|
|
|
|
2018-10-24 15:50:22 +02:00
|
|
|
/(vendor|system/vendor)/manifest\.xml u:object_r:vendor_configs_file:s0
|
|
|
|
|
/(vendor|system/vendor)/compatibility_matrix\.xml u:object_r:vendor_configs_file:s0
|
2018-01-19 02:53:35 +01:00
|
|
|
/(vendor|system/vendor)/etc/vintf(/.*)? u:object_r:vendor_configs_file:s0
|
2017-04-02 02:17:12 +02:00
|
|
|
/(vendor|system/vendor)/app(/.*)? u:object_r:vendor_app_file:s0
|
2017-11-20 13:09:55 +01:00
|
|
|
/(vendor|system/vendor)/priv-app(/.*)? u:object_r:vendor_app_file:s0
|
2017-04-02 02:17:12 +02:00
|
|
|
/(vendor|system/vendor)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
|
|
|
|
|
/(vendor|system/vendor)/framework(/.*)? u:object_r:vendor_framework_file:s0
|
|
|
|
|
|
2019-10-03 22:30:28 +02:00
|
|
|
/(vendor|system/vendor)/apex(/[^/]+){0,2} u:object_r:vendor_apex_file:s0
|
|
|
|
|
/(vendor|system/vendor)/bin/misc_writer u:object_r:vendor_misc_writer_exec:s0
|
|
|
|
|
/(vendor|system/vendor)/bin/boringssl_self_test(32|64) u:object_r:vendor_boringssl_self_test_exec:s0
|
2019-04-24 03:45:40 +02:00
|
|
|
|
2017-04-02 02:17:12 +02:00
|
|
|
# HAL location
|
|
|
|
|
/(vendor|system/vendor)/lib(64)?/hw u:object_r:vendor_hal_file:s0
|
|
|
|
|
|
2020-06-12 10:25:41 +02:00
|
|
|
/(vendor|system/vendor)/etc/selinux/vendor_service_contexts u:object_r:vendor_service_contexts_file:s0
|
2019-10-02 00:23:25 +02:00
|
|
|
|
2015-03-18 21:11:11 +01:00
|
|
|
#############################
|
2015-05-07 01:33:56 +02:00
|
|
|
# OEM and ODM files
|
2015-03-18 21:11:11 +01:00
|
|
|
#
|
2018-03-07 18:53:45 +01:00
|
|
|
/(odm|vendor/odm)(/.*)? u:object_r:vendor_file:s0
|
|
|
|
|
/(odm|vendor/odm)/lib(64)?/egl(/.*)? u:object_r:same_process_hal_file:s0
|
|
|
|
|
/(odm|vendor/odm)/lib(64)?/hw u:object_r:vendor_hal_file:s0
|
|
|
|
|
/(odm|vendor/odm)/lib(64)?/vndk-sp(/.*)? u:object_r:vndk_sp_file:s0
|
|
|
|
|
/(odm|vendor/odm)/bin/sh u:object_r:vendor_shell_exec:s0
|
|
|
|
|
/(odm|vendor/odm)/etc(/.*)? u:object_r:vendor_configs_file:s0
|
|
|
|
|
/(odm|vendor/odm)/app(/.*)? u:object_r:vendor_app_file:s0
|
|
|
|
|
/(odm|vendor/odm)/priv-app(/.*)? u:object_r:vendor_app_file:s0
|
|
|
|
|
/(odm|vendor/odm)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
|
|
|
|
|
/(odm|vendor/odm)/framework(/.*)? u:object_r:vendor_framework_file:s0
|
2017-12-13 03:54:59 +01:00
|
|
|
|
2021-11-18 23:59:29 +01:00
|
|
|
# secure-element service: vendor uuid mapping config file
|
|
|
|
|
/(odm|vendor/odm|vendor|system/vendor)/etc/hal_uuid_map_(.*)?\.xml u:object_r:vendor_uuid_mapping_config_file:s0
|
|
|
|
|
|
|
|
|
|
|
2018-10-08 21:04:15 +02:00
|
|
|
# Input configuration
|
2019-10-03 22:30:28 +02:00
|
|
|
/(odm|vendor/odm|vendor|system/vendor)/usr/keylayout(/.*)?\.kl u:object_r:vendor_keylayout_file:s0
|
|
|
|
|
/(odm|vendor/odm|vendor|system/vendor)/usr/keychars(/.*)?\.kcm u:object_r:vendor_keychars_file:s0
|
|
|
|
|
/(odm|vendor/odm|vendor|system/vendor)/usr/idc(/.*)?\.idc u:object_r:vendor_idc_file:s0
|
2018-10-08 21:04:15 +02:00
|
|
|
|
2015-05-07 01:33:56 +02:00
|
|
|
/oem(/.*)? u:object_r:oemfs:s0
|
2019-02-25 14:41:13 +01:00
|
|
|
/oem/overlay(/.*)? u:object_r:vendor_overlay_file:s0
|
2015-05-07 01:33:56 +02:00
|
|
|
|
2017-11-27 04:41:33 +01:00
|
|
|
# The precompiled monolithic sepolicy will be under /odm only when
|
|
|
|
|
# BOARD_USES_ODMIMAGE is true: a separate odm.img is built.
|
|
|
|
|
/odm/etc/selinux/precompiled_sepolicy u:object_r:sepolicy_file:s0
|
|
|
|
|
/odm/etc/selinux/precompiled_sepolicy\.plat_and_mapping\.sha256 u:object_r:sepolicy_file:s0
|
|
|
|
|
|
2022-10-24 13:41:45 +02:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_sepolicy\.cil u:object_r:sepolicy_file:s0
|
2017-11-29 09:14:53 +01:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_file_contexts u:object_r:file_contexts_file:s0
|
2017-11-29 09:15:28 +01:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_seapp_contexts u:object_r:seapp_contexts_file:s0
|
2017-11-29 09:15:55 +01:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_property_contexts u:object_r:property_contexts_file:s0
|
2022-10-24 13:41:45 +02:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_service_contexts u:object_r:vendor_service_contexts_file:s0
|
2017-11-29 09:16:26 +01:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
2022-10-24 13:41:45 +02:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0
|
|
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_mac_permissions\.xml u:object_r:mac_perms_file:s0
|
2015-03-18 21:11:11 +01:00
|
|
|
|
2018-01-17 07:27:35 +01:00
|
|
|
#############################
|
|
|
|
|
# Product files
|
|
|
|
|
#
|
2018-05-29 14:17:03 +02:00
|
|
|
/(product|system/product)(/.*)? u:object_r:system_file:s0
|
2019-07-15 22:33:48 +02:00
|
|
|
/(product|system/product)/etc/group u:object_r:system_group_file:s0
|
|
|
|
|
/(product|system/product)/etc/passwd u:object_r:system_passwd_file:s0
|
2021-11-29 07:30:18 +01:00
|
|
|
/(product|system/product)/overlay(/.*)? u:object_r:system_file:s0
|
2018-05-29 14:17:03 +02:00
|
|
|
|
2018-12-21 01:13:10 +01:00
|
|
|
/(product|system/product)/etc/selinux/product_file_contexts u:object_r:file_contexts_file:s0
|
|
|
|
|
/(product|system/product)/etc/selinux/product_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
2020-07-25 22:02:29 +02:00
|
|
|
/(product|system/product)/etc/selinux/product_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0
|
2018-12-21 04:31:42 +01:00
|
|
|
/(product|system/product)/etc/selinux/product_property_contexts u:object_r:property_contexts_file:s0
|
2018-12-21 19:46:45 +01:00
|
|
|
/(product|system/product)/etc/selinux/product_seapp_contexts u:object_r:seapp_contexts_file:s0
|
2018-12-21 21:28:14 +01:00
|
|
|
/(product|system/product)/etc/selinux/product_service_contexts u:object_r:service_contexts_file:s0
|
2018-12-22 01:07:21 +01:00
|
|
|
/(product|system/product)/etc/selinux/product_mac_permissions\.xml u:object_r:mac_perms_file:s0
|
2018-12-19 04:51:19 +01:00
|
|
|
|
2019-07-29 21:39:08 +02:00
|
|
|
/(product|system/product)/lib(64)?(/.*)? u:object_r:system_lib_file:s0
|
|
|
|
|
|
2018-05-29 14:17:03 +02:00
|
|
|
#############################
|
2019-06-26 02:27:36 +02:00
|
|
|
# SystemExt files
|
2018-05-29 14:17:03 +02:00
|
|
|
#
|
2019-06-26 02:27:36 +02:00
|
|
|
/(system_ext|system/system_ext)(/.*)? u:object_r:system_file:s0
|
2019-07-15 22:33:48 +02:00
|
|
|
/(system_ext|system/system_ext)/etc/group u:object_r:system_group_file:s0
|
|
|
|
|
/(system_ext|system/system_ext)/etc/passwd u:object_r:system_passwd_file:s0
|
2019-06-26 02:27:36 +02:00
|
|
|
/(system_ext|system/system_ext)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
|
2018-11-06 07:00:49 +01:00
|
|
|
|
2019-09-09 16:05:49 +02:00
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_file_contexts u:object_r:file_contexts_file:s0
|
|
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
2020-07-25 22:02:29 +02:00
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0
|
2019-09-09 16:05:49 +02:00
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_property_contexts u:object_r:property_contexts_file:s0
|
|
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_seapp_contexts u:object_r:seapp_contexts_file:s0
|
|
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_service_contexts u:object_r:service_contexts_file:s0
|
|
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_mac_permissions\.xml u:object_r:mac_perms_file:s0
|
2021-09-23 16:14:16 +02:00
|
|
|
/(system_ext|system/system_ext)/etc/selinux/userdebug_plat_sepolicy\.cil u:object_r:sepolicy_file:s0
|
2019-09-09 16:04:06 +02:00
|
|
|
|
2021-07-02 23:25:17 +02:00
|
|
|
/(system_ext|system/system_ext)/bin/aidl_lazy_test_server u:object_r:aidl_lazy_test_server_exec:s0
|
|
|
|
|
/(system_ext|system/system_ext)/bin/aidl_lazy_cb_test_server u:object_r:aidl_lazy_test_server_exec:s0
|
|
|
|
|
/(system_ext|system/system_ext)/bin/hidl_lazy_test_server u:object_r:hidl_lazy_test_server_exec:s0
|
|
|
|
|
/(system_ext|system/system_ext)/bin/hidl_lazy_cb_test_server u:object_r:hidl_lazy_test_server_exec:s0
|
2023-06-01 01:29:12 +02:00
|
|
|
/(system_ext|system/system_ext)/bin/hwservicemanager u:object_r:hwservicemanager_exec:s0
|
|
|
|
|
/(system_ext|system/system_ext)/bin/hw/android\.hidl\.allocator@1\.0-service u:object_r:hal_allocator_default_exec:s0
|
|
|
|
|
|
2020-01-27 23:19:22 +01:00
|
|
|
|
2023-01-23 22:47:19 +01:00
|
|
|
/(system_ext|system/system_ext)/bin/canhalconfigurator(-aidl)? u:object_r:canhalconfigurator_exec:s0
|
2023-01-14 01:31:24 +01:00
|
|
|
|
2020-07-02 04:22:43 +02:00
|
|
|
/(system_ext|system/system_ext)/lib(64)?(/.*)? u:object_r:system_lib_file:s0
|
|
|
|
|
|
2020-05-14 05:44:19 +02:00
|
|
|
#############################
|
|
|
|
|
# VendorDlkm files
|
|
|
|
|
# This includes VENDOR Dynamically Loadable Kernel Modules and other misc files.
|
|
|
|
|
#
|
|
|
|
|
/(vendor_dlkm|vendor/vendor_dlkm|system/vendor/vendor_dlkm)(/.*)? u:object_r:vendor_file:s0
|
2021-09-27 22:31:07 +02:00
|
|
|
/(vendor_dlkm|vendor/vendor_dlkm|system/vendor/vendor_dlkm)/etc(/.*)? u:object_r:vendor_configs_file:s0
|
2020-05-14 05:44:19 +02:00
|
|
|
|
2020-07-16 02:11:17 +02:00
|
|
|
#############################
|
|
|
|
|
# OdmDlkm files
|
|
|
|
|
# This includes ODM Dynamically Loadable Kernel Modules and other misc files.
|
|
|
|
|
#
|
|
|
|
|
/(odm_dlkm|vendor/odm_dlkm|system/vendor/odm_dlkm)(/.*)? u:object_r:vendor_file:s0
|
2021-09-27 22:31:07 +02:00
|
|
|
/(odm_dlkm|vendor/odm_dlkm|system/vendor/odm_dlkm)/etc(/.*)? u:object_r:vendor_configs_file:s0
|
2020-07-16 02:11:17 +02:00
|
|
|
|
2018-11-06 07:00:49 +01:00
|
|
|
#############################
|
|
|
|
|
# Vendor files from /(product|system/product)/vendor_overlay
|
|
|
|
|
#
|
|
|
|
|
# NOTE: For additional vendor file contexts for vendor overlay files,
|
|
|
|
|
# use device specific file_contexts.
|
|
|
|
|
#
|
|
|
|
|
/(product|system/product)/vendor_overlay/[0-9]+/.* u:object_r:vendor_file:s0
|
2018-01-17 07:27:35 +01:00
|
|
|
|
2013-03-20 20:03:04 +01:00
|
|
|
#############################
|
2012-01-04 18:33:27 +01:00
|
|
|
# Data files
|
|
|
|
|
#
|
2015-04-07 01:21:54 +02:00
|
|
|
# NOTE: When modifying existing label rules, changes may also need to
|
|
|
|
|
# propagate to the "Expanded data files" section.
|
|
|
|
|
#
|
2019-08-02 00:57:47 +02:00
|
|
|
/data u:object_r:system_data_root_file:s0
|
|
|
|
|
/data/(.*)? u:object_r:system_data_file:s0
|
2021-03-19 12:08:49 +01:00
|
|
|
/data/system/environ(/.*)? u:object_r:environ_system_data_file:s0
|
Relabel /data/system/packages.list to new type.
Conservatively grant access to packages_list_file to everything that had
access to system_data_file:file even if the comment in the SELinux
policy suggests it was for another use.
Ran a diff on the resulting SEPolicy, the only difference of domains
being granted is those that had system_data_file:dir permissiosn which
is clearly not applicable for packages.list
diff -u0 <(sesearch --allow -t system_data_file ~/sepolicy | sed 's/system_data_file/packages_list_file/') <(sesearch --allow -t packages_list_file ~/sepolicy_new)
--- /proc/self/fd/16 2019-03-19 20:01:44.378409146 +0000
+++ /proc/self/fd/18 2019-03-19 20:01:44.378409146 +0000
@@ -3 +2,0 @@
-allow appdomain packages_list_file:dir getattr;
@@ -6 +4,0 @@
-allow coredomain packages_list_file:dir getattr;
@@ -8 +5,0 @@
-allow domain packages_list_file:dir search;
@@ -35 +31,0 @@
-allow system_server packages_list_file:dir { rename search setattr read lock create reparent getattr write relabelfrom ioctl rmdir remove_name open add_name };
@@ -40 +35,0 @@
-allow tee packages_list_file:dir { search read lock getattr ioctl open };
@@ -43,3 +37,0 @@
-allow traced_probes packages_list_file:dir { read getattr open search };
-allow vendor_init packages_list_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name open add_name };
-allow vold packages_list_file:dir { search setattr read lock create getattr mounton write ioctl rmdir remove_name open add_name };
@@ -48 +39,0 @@
-allow vold_prepare_subdirs packages_list_file:dir { read write relabelfrom rmdir remove_name open add_name };
@@ -50 +40,0 @@
-allow zygote packages_list_file:dir { search read lock getattr ioctl open };
Bug: 123186697
Change-Id: Ieabf313653deb5314872b63cd47dadd535af7b07
2019-03-19 19:14:38 +01:00
|
|
|
/data/system/packages\.list u:object_r:packages_list_file:s0
|
2022-03-25 19:08:59 +01:00
|
|
|
/data/system/game_mode_intervention\.list u:object_r:game_mode_intervention_list_file:s0
|
2015-03-11 23:44:14 +01:00
|
|
|
/data/unencrypted(/.*)? u:object_r:unencrypted_data_file:s0
|
2012-12-04 14:13:58 +01:00
|
|
|
/data/backup(/.*)? u:object_r:backup_data_file:s0
|
|
|
|
|
/data/secure/backup(/.*)? u:object_r:backup_data_file:s0
|
2014-02-04 20:29:51 +01:00
|
|
|
/data/system/ndebugsocket u:object_r:system_ndebug_socket:s0
|
2019-12-30 06:38:38 +01:00
|
|
|
/data/system/unsolzygotesocket u:object_r:system_unsolzygote_socket:s0
|
2012-03-07 20:59:01 +01:00
|
|
|
/data/drm(/.*)? u:object_r:drm_data_file:s0
|
2014-06-16 23:19:31 +02:00
|
|
|
/data/resource-cache(/.*)? u:object_r:resourcecache_data_file:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/data/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0
|
2015-12-03 06:23:30 +01:00
|
|
|
/data/ota(/.*)? u:object_r:ota_data_file:s0
|
2016-05-25 06:07:48 +02:00
|
|
|
/data/ota_package(/.*)? u:object_r:ota_package_file:s0
|
2014-10-21 06:56:02 +02:00
|
|
|
/data/adb(/.*)? u:object_r:adb_data_file:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/data/anr(/.*)? u:object_r:anr_data_file:s0
|
2018-08-17 09:35:42 +02:00
|
|
|
/data/apex(/.*)? u:object_r:apex_data_file:s0
|
2019-03-01 12:28:23 +01:00
|
|
|
/data/apex/active/(.*)? u:object_r:staging_data_file:s0
|
|
|
|
|
/data/apex/backup/(.*)? u:object_r:staging_data_file:s0
|
2021-01-22 22:04:10 +01:00
|
|
|
/data/apex/decompressed/(.*)? u:object_r:staging_data_file:s0
|
2021-01-28 22:14:20 +01:00
|
|
|
/data/apex/ota_reserved(/.*)? u:object_r:apex_ota_reserved_file:s0
|
2014-07-07 19:58:53 +02:00
|
|
|
/data/app(/.*)? u:object_r:apk_data_file:s0
|
2020-01-23 20:20:00 +01:00
|
|
|
# Traditional /data/app/[packageName]-[randomString]/base.apk location
|
2015-03-04 03:19:12 +01:00
|
|
|
/data/app/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
2020-01-23 20:20:00 +01:00
|
|
|
# /data/app/[randomStringA]/[packageName]-[randomStringB]/base.apk layout
|
|
|
|
|
/data/app/[^/]+/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
2015-03-04 03:19:12 +01:00
|
|
|
/data/app/vmdl[^/]+\.tmp(/.*)? u:object_r:apk_tmp_file:s0
|
|
|
|
|
/data/app/vmdl[^/]+\.tmp/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
2014-07-07 19:58:53 +02:00
|
|
|
/data/app-private(/.*)? u:object_r:apk_private_data_file:s0
|
|
|
|
|
/data/app-private/vmdl.*\.tmp(/.*)? u:object_r:apk_private_tmp_file:s0
|
2019-01-23 04:05:29 +01:00
|
|
|
/data/gsi(/.*)? u:object_r:gsi_data_file:s0
|
2020-12-25 10:32:13 +01:00
|
|
|
/data/gsi_persistent_data u:object_r:gsi_persistent_data_file:s0
|
2019-08-07 22:01:15 +02:00
|
|
|
/data/gsi/ota(/.*)? u:object_r:ota_image_data_file:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/data/tombstones(/.*)? u:object_r:tombstone_data_file:s0
|
2020-09-01 01:11:11 +02:00
|
|
|
/data/local/tests(/.*)? u:object_r:shell_test_data_file:s0
|
2013-03-26 19:00:13 +01:00
|
|
|
/data/local/tmp(/.*)? u:object_r:shell_data_file:s0
|
2018-02-20 21:41:30 +01:00
|
|
|
/data/local/tmp/ltp(/.*)? u:object_r:nativetest_data_file:s0
|
2018-01-16 01:44:04 +01:00
|
|
|
/data/local/traces(/.*)? u:object_r:trace_data_file:s0
|
Restrict creating per-user encrypted directories
Creating a per-user encrypted directory such as /data/system_ce/0 and
the subdirectories in it too early has been a recurring bug. Typically,
individual services in system_server are to blame; system_server has
permission to create these directories, and it's easy to write
"mkdirs()" instead of "mkdir()". Such bugs are very bad, as they
prevent these directories from being encrypted, as encryption policies
can only be set on empty directories. Due to recent changes, a factory
reset is now forced in such cases, which helps detect these bugs;
however, it would be much better to prevent them in the first place.
This CL locks down the ability to create these directories to just vold
and init, or to just vold when possible. This is done by assigning new
types to the directories that contain these directories, and then only
allowing the needed domains to write to these parent directories. This
is similar to what https://r.android.com/1117297 did for /data itself.
Three new types are used instead of just one, since these directories
had three different types already (system_data_file, media_rw_data_file,
vendor_data_file), and this allows the policy to be a bit more precise.
A significant limitation is that /data/user/0 is currently being created
by init during early boot. Therefore, this CL doesn't help much for
/data/user/0, though it helps a lot for the other directories. As the
next step, I'll try to eliminate the /data/user/0 quirk. Anyway, this
CL is needed regardless of whether we're able to do that.
Test: Booted cuttlefish. Ran 'sm partition disk:253,32 private', then
created and deleted a user. Used 'ls -lZ' to check the relevant
SELinux labels on both internal and adoptable storage. Also did
similar tests on raven, with the addition of going through the
setup wizard and using an app that creates media files. No
relevant SELinux denials seen during any of this.
Bug: 156305599
Change-Id: I1fbdd180f56dd2fe4703763936f5850cef8ab0ba
2022-05-05 00:18:02 +02:00
|
|
|
/data/media u:object_r:media_userdir_file:s0
|
|
|
|
|
/data/media/.* u:object_r:media_rw_data_file:s0
|
2014-01-08 03:53:01 +01:00
|
|
|
/data/mediadrm(/.*)? u:object_r:media_data_file:s0
|
2015-10-29 00:45:58 +01:00
|
|
|
/data/nativetest(/.*)? u:object_r:nativetest_data_file:s0
|
2017-01-12 23:18:50 +01:00
|
|
|
/data/nativetest64(/.*)? u:object_r:nativetest_data_file:s0
|
2019-04-09 18:12:13 +02:00
|
|
|
# This directory was removed after Q Beta 2, but we need to preserve labels for upgrading devices.
|
|
|
|
|
/data/pkg_staging(/.*)? u:object_r:staging_data_file:s0
|
2014-05-29 15:22:16 +02:00
|
|
|
/data/property(/.*)? u:object_r:property_data_file:s0
|
2016-05-20 20:08:45 +02:00
|
|
|
/data/preloads(/.*)? u:object_r:preloads_data_file:s0
|
2017-03-14 19:42:03 +01:00
|
|
|
/data/preloads/media(/.*)? u:object_r:preloads_media_file:s0
|
|
|
|
|
/data/preloads/demo(/.*)? u:object_r:preloads_media_file:s0
|
2018-11-09 01:46:19 +01:00
|
|
|
/data/server_configurable_flags(/.*)? u:object_r:server_configurable_flags_data_file:s0
|
2019-02-27 12:21:20 +01:00
|
|
|
/data/app-staging(/.*)? u:object_r:staging_data_file:s0
|
2020-11-23 09:29:55 +01:00
|
|
|
# Ensure we have the same labels as /data/app or /data/apex/active
|
|
|
|
|
# to avoid restorecon conflicts
|
|
|
|
|
/data/rollback/\d+/[^/]+/.*\.apk u:object_r:apk_data_file:s0
|
|
|
|
|
/data/rollback/\d+/[^/]+/.*\.apex u:object_r:staging_data_file:s0
|
2021-01-21 22:08:31 +01:00
|
|
|
/data/fonts/files(/.*)? u:object_r:font_data_file:s0
|
Restrict creating per-user encrypted directories
Creating a per-user encrypted directory such as /data/system_ce/0 and
the subdirectories in it too early has been a recurring bug. Typically,
individual services in system_server are to blame; system_server has
permission to create these directories, and it's easy to write
"mkdirs()" instead of "mkdir()". Such bugs are very bad, as they
prevent these directories from being encrypted, as encryption policies
can only be set on empty directories. Due to recent changes, a factory
reset is now forced in such cases, which helps detect these bugs;
however, it would be much better to prevent them in the first place.
This CL locks down the ability to create these directories to just vold
and init, or to just vold when possible. This is done by assigning new
types to the directories that contain these directories, and then only
allowing the needed domains to write to these parent directories. This
is similar to what https://r.android.com/1117297 did for /data itself.
Three new types are used instead of just one, since these directories
had three different types already (system_data_file, media_rw_data_file,
vendor_data_file), and this allows the policy to be a bit more precise.
A significant limitation is that /data/user/0 is currently being created
by init during early boot. Therefore, this CL doesn't help much for
/data/user/0, though it helps a lot for the other directories. As the
next step, I'll try to eliminate the /data/user/0 quirk. Anyway, this
CL is needed regardless of whether we're able to do that.
Test: Booted cuttlefish. Ran 'sm partition disk:253,32 private', then
created and deleted a user. Used 'ls -lZ' to check the relevant
SELinux labels on both internal and adoptable storage. Also did
similar tests on raven, with the addition of going through the
setup wizard and using an app that creates media files. No
relevant SELinux denials seen during any of this.
Bug: 156305599
Change-Id: I1fbdd180f56dd2fe4703763936f5850cef8ab0ba
2022-05-05 00:18:02 +02:00
|
|
|
/data/misc_ce u:object_r:system_userdir_file:s0
|
|
|
|
|
/data/misc_de u:object_r:system_userdir_file:s0
|
|
|
|
|
/data/system_ce u:object_r:system_userdir_file:s0
|
|
|
|
|
/data/system_de u:object_r:system_userdir_file:s0
|
|
|
|
|
/data/user u:object_r:system_userdir_file:s0
|
|
|
|
|
/data/user_de u:object_r:system_userdir_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
# Misc data
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/adb(/.*)? u:object_r:adb_keys_file:s0
|
2021-05-26 18:47:19 +02:00
|
|
|
/data/misc/a11ytrace(/.*)? u:object_r:accessibility_trace_data_file:s0
|
2019-11-19 19:10:16 +01:00
|
|
|
/data/misc/apexdata(/.*)? u:object_r:apex_module_data_file:s0
|
2021-05-26 18:47:19 +02:00
|
|
|
/data/misc/apexdata/com\.android\.art(/.*)? u:object_r:apex_art_data_file:s0
|
2021-07-12 16:12:37 +02:00
|
|
|
/data/misc/apexdata/com\.android\.compos(/.*)? u:object_r:apex_compos_data_file:s0
|
2023-08-31 13:37:30 +02:00
|
|
|
/data/misc/apexdata/com\.android\.virt(/.*)? u:object_r:apex_virt_data_file:s0
|
2021-07-12 15:21:48 +02:00
|
|
|
/data/misc/apexdata/com\.android\.permission(/.*)? u:object_r:apex_system_server_data_file:s0
|
|
|
|
|
/data/misc/apexdata/com\.android\.scheduling(/.*)? u:object_r:apex_system_server_data_file:s0
|
2024-01-02 08:10:27 +01:00
|
|
|
/data/misc/apexdata/com\.android\.tethering(/.*)? u:object_r:apex_tethering_data_file:s0
|
2021-08-30 22:02:16 +02:00
|
|
|
/data/misc/apexdata/com\.android\.uwb(/.*)? u:object_r:apex_system_server_data_file:s0
|
2021-07-12 15:21:48 +02:00
|
|
|
/data/misc/apexdata/com\.android\.wifi(/.*)? u:object_r:apex_system_server_data_file:s0
|
2019-12-02 19:29:48 +01:00
|
|
|
/data/misc/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
|
2018-05-21 17:01:02 +02:00
|
|
|
/data/misc/apns(/.*)? u:object_r:radio_data_file:s0
|
2020-12-23 16:21:23 +01:00
|
|
|
/data/misc/appcompat(/.*)? u:object_r:appcompat_data_file:s0
|
2013-11-07 19:42:46 +01:00
|
|
|
/data/misc/audio(/.*)? u:object_r:audio_data_file:s0
|
2016-02-24 01:16:16 +01:00
|
|
|
/data/misc/audioserver(/.*)? u:object_r:audioserver_data_file:s0
|
2016-08-04 22:40:23 +02:00
|
|
|
/data/misc/audiohal(/.*)? u:object_r:audiohal_data_file:s0
|
2016-01-19 19:54:20 +01:00
|
|
|
/data/misc/bootstat(/.*)? u:object_r:bootstat_data_file:s0
|
2015-06-24 08:24:17 +02:00
|
|
|
/data/misc/boottrace(/.*)? u:object_r:boottrace_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/bluetooth(/.*)? u:object_r:bluetooth_data_file:s0
|
2016-09-16 21:55:42 +02:00
|
|
|
/data/misc/bluetooth/logs(/.*)? u:object_r:bluetooth_logs_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/bluedroid(/.*)? u:object_r:bluetooth_data_file:s0
|
2014-02-04 20:29:51 +01:00
|
|
|
/data/misc/bluedroid/\.a2dp_ctrl u:object_r:bluetooth_socket:s0
|
|
|
|
|
/data/misc/bluedroid/\.a2dp_data u:object_r:bluetooth_socket:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/camera(/.*)? u:object_r:camera_data_file:s0
|
2018-01-02 19:21:33 +01:00
|
|
|
/data/misc/carrierid(/.*)? u:object_r:radio_data_file:s0
|
2012-08-15 12:25:14 +02:00
|
|
|
/data/misc/dhcp(/.*)? u:object_r:dhcp_data_file:s0
|
2018-10-24 15:50:22 +02:00
|
|
|
/data/misc/dhcp-6\.8\.2(/.*)? u:object_r:dhcp_data_file:s0
|
2022-01-28 19:48:27 +01:00
|
|
|
/data/misc/dmesgd(/.*)? u:object_r:dmesgd_data_file:s0
|
2019-10-15 22:13:56 +02:00
|
|
|
/data/misc/emergencynumberdb(/.*)? u:object_r:emergency_data_file:s0
|
2015-04-18 02:56:31 +02:00
|
|
|
/data/misc/gatekeeper(/.*)? u:object_r:gatekeeper_data_file:s0
|
2016-11-21 08:23:04 +01:00
|
|
|
/data/misc/incidents(/.*)? u:object_r:incident_data_file:s0
|
2019-08-16 22:41:55 +02:00
|
|
|
/data/misc/installd(/.*)? u:object_r:install_data_file:s0
|
2014-10-13 13:10:08 +02:00
|
|
|
/data/misc/keychain(/.*)? u:object_r:keychain_data_file:s0
|
2020-01-17 22:47:53 +01:00
|
|
|
/data/misc/credstore(/.*)? u:object_r:credstore_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0
|
2015-05-27 00:12:45 +02:00
|
|
|
/data/misc/logd(/.*)? u:object_r:misc_logd_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/media(/.*)? u:object_r:media_data_file:s0
|
2014-07-08 07:04:57 +02:00
|
|
|
/data/misc/net(/.*)? u:object_r:net_data_file:s0
|
2017-12-14 10:56:32 +01:00
|
|
|
/data/misc/network_watchlist(/.*)? u:object_r:network_watchlist_data_file:s0
|
2024-01-13 15:40:40 +01:00
|
|
|
/data/misc/telephonyconfig(/.*)? u:object_r:radio_data_file:s0
|
2020-07-08 11:09:49 +02:00
|
|
|
/data/misc/nfc/logs(/.*)? u:object_r:nfc_logs_data_file:s0
|
2021-04-09 16:17:38 +02:00
|
|
|
/data/misc/odrefresh(/.*)? u:object_r:odrefresh_data_file:s0
|
2020-11-27 12:23:54 +01:00
|
|
|
/data/misc/odsign(/.*)? u:object_r:odsign_data_file:s0
|
2022-02-24 12:50:35 +01:00
|
|
|
/data/misc/odsign/metrics(/.*)? u:object_r:odsign_metrics_file:s0
|
2021-01-07 18:12:21 +01:00
|
|
|
/data/misc/perfetto-traces(/.*)? u:object_r:perfetto_traces_data_file:s0
|
2023-10-20 04:28:11 +02:00
|
|
|
/data/misc/perfetto-traces/bugreport(.*)? u:object_r:perfetto_traces_bugreport_data_file:s0
|
2021-01-07 18:12:21 +01:00
|
|
|
/data/misc/perfetto-configs(/.*)? u:object_r:perfetto_configs_data_file:s0
|
2023-12-15 01:48:23 +01:00
|
|
|
/data/misc/uprobestats-configs(/.*)? u:object_r:uprobestats_configs_data_file:s0
|
2020-01-02 09:14:48 +01:00
|
|
|
/data/misc/prereboot(/.*)? u:object_r:prereboot_data_file:s0
|
2020-06-18 06:43:23 +02:00
|
|
|
/data/misc/profcollectd(/.*)? u:object_r:profcollectd_data_file:s0
|
2020-12-24 08:11:15 +01:00
|
|
|
/data/misc/radio(/.*)? u:object_r:radio_core_data_file:s0
|
2016-03-16 16:11:49 +01:00
|
|
|
/data/misc/recovery(/.*)? u:object_r:recovery_data_file:s0
|
2014-05-23 12:01:58 +02:00
|
|
|
/data/misc/shared_relro(/.*)? u:object_r:shared_relro_file:s0
|
2014-03-18 18:29:51 +01:00
|
|
|
/data/misc/sms(/.*)? u:object_r:radio_data_file:s0
|
2020-02-04 02:01:49 +01:00
|
|
|
/data/misc/snapshotctl_log(/.*)? u:object_r:snapshotctl_log_data_file:s0
|
2019-02-05 22:30:17 +01:00
|
|
|
/data/misc/stats-active-metric(/.*)? u:object_r:stats_data_file:s0
|
2017-12-19 00:14:33 +01:00
|
|
|
/data/misc/stats-data(/.*)? u:object_r:stats_data_file:s0
|
2023-02-02 20:57:18 +01:00
|
|
|
/data/misc/stats-service(/.*)? u:object_r:stats_config_data_file:s0
|
2020-03-05 00:09:54 +01:00
|
|
|
/data/misc/stats-metadata(/.*)? u:object_r:stats_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/systemkeys(/.*)? u:object_r:systemkeys_data_file:s0
|
2017-04-26 22:20:20 +02:00
|
|
|
/data/misc/textclassifier(/.*)? u:object_r:textclassifier_data_file:s0
|
2019-02-13 00:40:02 +01:00
|
|
|
/data/misc/train-info(/.*)? u:object_r:stats_data_file:s0
|
2014-10-13 13:10:08 +02:00
|
|
|
/data/misc/user(/.*)? u:object_r:misc_user_data_file:s0
|
2021-05-19 19:10:43 +02:00
|
|
|
/data/misc/virtualizationservice(/.*)? u:object_r:virtualizationservice_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/vpn(/.*)? u:object_r:vpn_data_file:s0
|
|
|
|
|
/data/misc/wifi(/.*)? u:object_r:wifi_data_file:s0
|
2019-06-10 21:46:09 +02:00
|
|
|
/data/misc_ce/[0-9]+/wifi(/.*)? u:object_r:wifi_data_file:s0
|
2014-01-29 19:45:51 +01:00
|
|
|
/data/misc/wifi/sockets(/.*)? u:object_r:wpa_socket:s0
|
|
|
|
|
/data/misc/wifi/sockets/wpa_ctrl.* u:object_r:system_wpa_socket:s0
|
2015-04-01 00:03:13 +02:00
|
|
|
/data/misc/vold(/.*)? u:object_r:vold_data_file:s0
|
2015-10-05 23:04:39 +02:00
|
|
|
/data/misc/update_engine(/.*)? u:object_r:update_engine_data_file:s0
|
2017-11-06 12:56:00 +01:00
|
|
|
/data/misc/update_engine_log(/.*)? u:object_r:update_engine_log_data_file:s0
|
2023-04-29 02:25:49 +02:00
|
|
|
/data/misc/snapuserd_log(/.*)? u:object_r:snapuserd_log_data_file:s0
|
2018-04-16 16:49:49 +02:00
|
|
|
/data/system/dropbox(/.*)? u:object_r:dropbox_data_file:s0
|
2015-04-08 01:40:44 +02:00
|
|
|
/data/system/heapdump(/.*)? u:object_r:heapdump_data_file:s0
|
2015-11-10 19:49:57 +01:00
|
|
|
/data/misc/trace(/.*)? u:object_r:method_trace_data_file:s0
|
2017-11-17 17:23:32 +01:00
|
|
|
/data/misc/wmtrace(/.*)? u:object_r:wm_trace_data_file:s0
|
2016-02-01 20:28:39 +01:00
|
|
|
# TODO(calin) label profile reference differently so that only
|
|
|
|
|
# profman run as a special user can write to them
|
2020-12-04 15:07:52 +01:00
|
|
|
/data/misc/profiles/cur(/[0-9]+)? u:object_r:user_profile_root_file:s0
|
|
|
|
|
/data/misc/profiles/cur/[0-9]+/.* u:object_r:user_profile_data_file:s0
|
2016-02-01 20:28:39 +01:00
|
|
|
/data/misc/profiles/ref(/.*)? u:object_r:user_profile_data_file:s0
|
2016-05-27 21:41:35 +02:00
|
|
|
/data/misc/profman(/.*)? u:object_r:profman_dump_data_file:s0
|
2018-02-08 01:29:06 +01:00
|
|
|
/data/vendor(/.*)? u:object_r:vendor_data_file:s0
|
Restrict creating per-user encrypted directories
Creating a per-user encrypted directory such as /data/system_ce/0 and
the subdirectories in it too early has been a recurring bug. Typically,
individual services in system_server are to blame; system_server has
permission to create these directories, and it's easy to write
"mkdirs()" instead of "mkdir()". Such bugs are very bad, as they
prevent these directories from being encrypted, as encryption policies
can only be set on empty directories. Due to recent changes, a factory
reset is now forced in such cases, which helps detect these bugs;
however, it would be much better to prevent them in the first place.
This CL locks down the ability to create these directories to just vold
and init, or to just vold when possible. This is done by assigning new
types to the directories that contain these directories, and then only
allowing the needed domains to write to these parent directories. This
is similar to what https://r.android.com/1117297 did for /data itself.
Three new types are used instead of just one, since these directories
had three different types already (system_data_file, media_rw_data_file,
vendor_data_file), and this allows the policy to be a bit more precise.
A significant limitation is that /data/user/0 is currently being created
by init during early boot. Therefore, this CL doesn't help much for
/data/user/0, though it helps a lot for the other directories. As the
next step, I'll try to eliminate the /data/user/0 quirk. Anyway, this
CL is needed regardless of whether we're able to do that.
Test: Booted cuttlefish. Ran 'sm partition disk:253,32 private', then
created and deleted a user. Used 'ls -lZ' to check the relevant
SELinux labels on both internal and adoptable storage. Also did
similar tests on raven, with the addition of going through the
setup wizard and using an app that creates media files. No
relevant SELinux denials seen during any of this.
Bug: 156305599
Change-Id: I1fbdd180f56dd2fe4703763936f5850cef8ab0ba
2022-05-05 00:18:02 +02:00
|
|
|
/data/vendor_ce u:object_r:vendor_userdir_file:s0
|
|
|
|
|
/data/vendor_ce/.* u:object_r:vendor_data_file:s0
|
|
|
|
|
/data/vendor_de u:object_r:vendor_userdir_file:s0
|
|
|
|
|
/data/vendor_de/.* u:object_r:vendor_data_file:s0
|
2023-10-20 04:28:11 +02:00
|
|
|
/data/vendor/tombstones/wifi(/.*)? u:object_r:tombstone_wifi_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
|
2017-10-17 01:39:13 +02:00
|
|
|
# storaged proto files
|
2017-10-19 23:41:37 +02:00
|
|
|
/data/misc_de/[0-9]+/storaged(/.*)? u:object_r:storaged_data_file:s0
|
2017-10-17 01:39:13 +02:00
|
|
|
/data/misc_ce/[0-9]+/storaged(/.*)? u:object_r:storaged_data_file:s0
|
|
|
|
|
|
2021-10-06 07:13:20 +02:00
|
|
|
# checkin data files
|
|
|
|
|
/data/misc_ce/[0-9]+/checkin(/.*)? u:object_r:checkin_data_file:s0
|
|
|
|
|
|
2015-05-13 00:16:06 +02:00
|
|
|
# Fingerprint data
|
|
|
|
|
/data/system/users/[0-9]+/fpdata(/.*)? u:object_r:fingerprintd_data_file:s0
|
|
|
|
|
|
2018-01-22 22:24:10 +01:00
|
|
|
# Fingerprint vendor data file
|
2018-11-19 19:42:11 +01:00
|
|
|
/data/vendor_de/[0-9]+/fpdata(/.*)? u:object_r:fingerprint_vendor_data_file:s0
|
2018-01-22 22:24:10 +01:00
|
|
|
|
2018-11-16 00:28:07 +01:00
|
|
|
# Face vendor data file
|
|
|
|
|
/data/vendor_de/[0-9]+/facedata(/.*)? u:object_r:face_vendor_data_file:s0
|
2019-04-24 02:26:12 +02:00
|
|
|
/data/vendor_ce/[0-9]+/facedata(/.*)? u:object_r:face_vendor_data_file:s0
|
2018-11-16 00:28:07 +01:00
|
|
|
|
|
|
|
|
# Iris vendor data file
|
|
|
|
|
/data/vendor_de/[0-9]+/irisdata(/.*)? u:object_r:iris_vendor_data_file:s0
|
|
|
|
|
|
2014-12-05 06:40:22 +01:00
|
|
|
# Bootchart data
|
|
|
|
|
/data/bootchart(/.*)? u:object_r:bootchart_data_file:s0
|
|
|
|
|
|
2022-05-11 22:43:54 +02:00
|
|
|
# Sandbox sdk data (managed by installd)
|
|
|
|
|
/data/misc_de/[0-9]+/sdksandbox u:object_r:sdk_sandbox_system_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/sdksandbox u:object_r:sdk_sandbox_system_data_file:s0
|
|
|
|
|
|
2019-01-14 16:02:12 +01:00
|
|
|
# App data snapshots (managed by installd).
|
|
|
|
|
/data/misc_de/[0-9]+/rollback(/.*)? u:object_r:rollback_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/rollback(/.*)? u:object_r:rollback_data_file:s0
|
|
|
|
|
|
2019-11-19 19:10:16 +01:00
|
|
|
# Apex data directories
|
|
|
|
|
/data/misc_de/[0-9]+/apexdata(/.*)? u:object_r:apex_module_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/apexdata(/.*)? u:object_r:apex_module_data_file:s0
|
2021-07-12 15:21:48 +02:00
|
|
|
/data/misc_ce/[0-9]+/apexdata/com\.android\.appsearch(/.*)? u:object_r:apex_system_server_data_file:s0
|
|
|
|
|
/data/misc_de/[0-9]+/apexdata/com\.android\.permission(/.*)? u:object_r:apex_system_server_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/apexdata/com\.android\.permission(/.*)? u:object_r:apex_system_server_data_file:s0
|
|
|
|
|
/data/misc_de/[0-9]+/apexdata/com\.android\.wifi(/.*)? u:object_r:apex_system_server_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/apexdata/com\.android\.wifi(/.*)? u:object_r:apex_system_server_data_file:s0
|
2022-04-15 22:33:20 +02:00
|
|
|
/data/misc_de/[0-9]+/apexdata/com\.android\.uwb(/.*)? u:object_r:apex_system_server_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/apexdata/com\.android\.uwb(/.*)? u:object_r:apex_system_server_data_file:s0
|
2019-11-19 19:10:16 +01:00
|
|
|
|
2019-12-02 19:29:48 +01:00
|
|
|
# Apex rollback directories
|
|
|
|
|
/data/misc_de/[0-9]+/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
|
|
|
|
|
|
2020-01-13 18:33:08 +01:00
|
|
|
# Incremental directories
|
2020-02-13 03:16:09 +01:00
|
|
|
/data/incremental(/.*)? u:object_r:apk_data_file:s0
|
|
|
|
|
/data/incremental/MT_[^/]+/mount/.pending_reads u:object_r:incremental_control_file:s0
|
|
|
|
|
/data/incremental/MT_[^/]+/mount/.log u:object_r:incremental_control_file:s0
|
2021-01-15 06:01:25 +01:00
|
|
|
/data/incremental/MT_[^/]+/mount/.blocks_written u:object_r:incremental_control_file:s0
|
2020-01-13 18:33:08 +01:00
|
|
|
|
2021-12-23 23:37:41 +01:00
|
|
|
# Boot animation data
|
2023-07-26 00:02:33 +02:00
|
|
|
/data/misc/bootanim(/.*)? u:object_r:bootanim_data_file:s0
|
2015-04-07 01:21:54 +02:00
|
|
|
#############################
|
|
|
|
|
# Expanded data files
|
|
|
|
|
#
|
Restrict creating per-user encrypted directories
Creating a per-user encrypted directory such as /data/system_ce/0 and
the subdirectories in it too early has been a recurring bug. Typically,
individual services in system_server are to blame; system_server has
permission to create these directories, and it's easy to write
"mkdirs()" instead of "mkdir()". Such bugs are very bad, as they
prevent these directories from being encrypted, as encryption policies
can only be set on empty directories. Due to recent changes, a factory
reset is now forced in such cases, which helps detect these bugs;
however, it would be much better to prevent them in the first place.
This CL locks down the ability to create these directories to just vold
and init, or to just vold when possible. This is done by assigning new
types to the directories that contain these directories, and then only
allowing the needed domains to write to these parent directories. This
is similar to what https://r.android.com/1117297 did for /data itself.
Three new types are used instead of just one, since these directories
had three different types already (system_data_file, media_rw_data_file,
vendor_data_file), and this allows the policy to be a bit more precise.
A significant limitation is that /data/user/0 is currently being created
by init during early boot. Therefore, this CL doesn't help much for
/data/user/0, though it helps a lot for the other directories. As the
next step, I'll try to eliminate the /data/user/0 quirk. Anyway, this
CL is needed regardless of whether we're able to do that.
Test: Booted cuttlefish. Ran 'sm partition disk:253,32 private', then
created and deleted a user. Used 'ls -lZ' to check the relevant
SELinux labels on both internal and adoptable storage. Also did
similar tests on raven, with the addition of going through the
setup wizard and using an app that creates media files. No
relevant SELinux denials seen during any of this.
Bug: 156305599
Change-Id: I1fbdd180f56dd2fe4703763936f5850cef8ab0ba
2022-05-05 00:18:02 +02:00
|
|
|
/mnt/expand u:object_r:mnt_expand_file:s0
|
2023-11-08 00:19:55 +01:00
|
|
|
/mnt/expand/[^/]+(/.*)? u:object_r:system_data_file:s0
|
2015-04-07 01:21:54 +02:00
|
|
|
/mnt/expand/[^/]+/app(/.*)? u:object_r:apk_data_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/app/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
2020-02-17 13:33:57 +01:00
|
|
|
# /mnt/expand/..../app/[randomStringA]/[packageName]-[randomStringB]/base.apk layout
|
|
|
|
|
/mnt/expand/[^/]+/app/[^/]+/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
2015-04-07 01:21:54 +02:00
|
|
|
/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp(/.*)? u:object_r:apk_tmp_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/local/tmp(/.*)? u:object_r:shell_data_file:s0
|
Restrict creating per-user encrypted directories
Creating a per-user encrypted directory such as /data/system_ce/0 and
the subdirectories in it too early has been a recurring bug. Typically,
individual services in system_server are to blame; system_server has
permission to create these directories, and it's easy to write
"mkdirs()" instead of "mkdir()". Such bugs are very bad, as they
prevent these directories from being encrypted, as encryption policies
can only be set on empty directories. Due to recent changes, a factory
reset is now forced in such cases, which helps detect these bugs;
however, it would be much better to prevent them in the first place.
This CL locks down the ability to create these directories to just vold
and init, or to just vold when possible. This is done by assigning new
types to the directories that contain these directories, and then only
allowing the needed domains to write to these parent directories. This
is similar to what https://r.android.com/1117297 did for /data itself.
Three new types are used instead of just one, since these directories
had three different types already (system_data_file, media_rw_data_file,
vendor_data_file), and this allows the policy to be a bit more precise.
A significant limitation is that /data/user/0 is currently being created
by init during early boot. Therefore, this CL doesn't help much for
/data/user/0, though it helps a lot for the other directories. As the
next step, I'll try to eliminate the /data/user/0 quirk. Anyway, this
CL is needed regardless of whether we're able to do that.
Test: Booted cuttlefish. Ran 'sm partition disk:253,32 private', then
created and deleted a user. Used 'ls -lZ' to check the relevant
SELinux labels on both internal and adoptable storage. Also did
similar tests on raven, with the addition of going through the
setup wizard and using an app that creates media files. No
relevant SELinux denials seen during any of this.
Bug: 156305599
Change-Id: I1fbdd180f56dd2fe4703763936f5850cef8ab0ba
2022-05-05 00:18:02 +02:00
|
|
|
/mnt/expand/[^/]+/media u:object_r:media_userdir_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/media/.* u:object_r:media_rw_data_file:s0
|
2015-05-15 05:55:31 +02:00
|
|
|
/mnt/expand/[^/]+/misc/vold(/.*)? u:object_r:vold_data_file:s0
|
Restrict creating per-user encrypted directories
Creating a per-user encrypted directory such as /data/system_ce/0 and
the subdirectories in it too early has been a recurring bug. Typically,
individual services in system_server are to blame; system_server has
permission to create these directories, and it's easy to write
"mkdirs()" instead of "mkdir()". Such bugs are very bad, as they
prevent these directories from being encrypted, as encryption policies
can only be set on empty directories. Due to recent changes, a factory
reset is now forced in such cases, which helps detect these bugs;
however, it would be much better to prevent them in the first place.
This CL locks down the ability to create these directories to just vold
and init, or to just vold when possible. This is done by assigning new
types to the directories that contain these directories, and then only
allowing the needed domains to write to these parent directories. This
is similar to what https://r.android.com/1117297 did for /data itself.
Three new types are used instead of just one, since these directories
had three different types already (system_data_file, media_rw_data_file,
vendor_data_file), and this allows the policy to be a bit more precise.
A significant limitation is that /data/user/0 is currently being created
by init during early boot. Therefore, this CL doesn't help much for
/data/user/0, though it helps a lot for the other directories. As the
next step, I'll try to eliminate the /data/user/0 quirk. Anyway, this
CL is needed regardless of whether we're able to do that.
Test: Booted cuttlefish. Ran 'sm partition disk:253,32 private', then
created and deleted a user. Used 'ls -lZ' to check the relevant
SELinux labels on both internal and adoptable storage. Also did
similar tests on raven, with the addition of going through the
setup wizard and using an app that creates media files. No
relevant SELinux denials seen during any of this.
Bug: 156305599
Change-Id: I1fbdd180f56dd2fe4703763936f5850cef8ab0ba
2022-05-05 00:18:02 +02:00
|
|
|
/mnt/expand/[^/]+/misc_ce u:object_r:system_userdir_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/misc_de u:object_r:system_userdir_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/user u:object_r:system_userdir_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/user_de u:object_r:system_userdir_file:s0
|
2015-04-07 01:21:54 +02:00
|
|
|
|
2014-10-31 20:40:12 +01:00
|
|
|
# coredump directory for userdebug/eng devices
|
|
|
|
|
/cores(/.*)? u:object_r:coredump_file:s0
|
|
|
|
|
|
2016-01-27 01:39:34 +01:00
|
|
|
# Wallpaper files
|
2016-02-11 04:39:12 +01:00
|
|
|
/data/system/users/[0-9]+/wallpaper_lock_orig u:object_r:wallpaper_file:s0
|
|
|
|
|
/data/system/users/[0-9]+/wallpaper_lock u:object_r:wallpaper_file:s0
|
2016-01-27 01:39:34 +01:00
|
|
|
/data/system/users/[0-9]+/wallpaper_orig u:object_r:wallpaper_file:s0
|
2012-11-30 16:41:14 +01:00
|
|
|
/data/system/users/[0-9]+/wallpaper u:object_r:wallpaper_file:s0
|
2016-02-23 01:50:01 +01:00
|
|
|
|
|
|
|
|
# Ringtone files
|
|
|
|
|
/data/system_de/[0-9]+/ringtones(/.*)? u:object_r:ringtone_file:s0
|
|
|
|
|
|
2016-03-09 00:06:44 +01:00
|
|
|
# ShortcutManager icons, e.g.
|
|
|
|
|
# /data/system_ce/0/shortcut_service/bitmaps/com.example.app/1457472879282.png
|
|
|
|
|
/data/system_ce/[0-9]+/shortcut_service/bitmaps(/.*)? u:object_r:shortcut_manager_icons:s0
|
|
|
|
|
|
2016-02-25 16:37:06 +01:00
|
|
|
# User icon files
|
2018-10-24 15:50:22 +02:00
|
|
|
/data/system/users/[0-9]+/photo\.png u:object_r:icon_file:s0
|
2016-02-25 16:37:06 +01:00
|
|
|
|
2023-02-06 09:32:45 +01:00
|
|
|
# Shutdown-checkpoints files
|
|
|
|
|
/data/system/shutdown-checkpoints(/.*)? u:object_r:shutdown_checkpoints_system_data_file:s0
|
|
|
|
|
|
2017-10-13 23:54:32 +02:00
|
|
|
# vold per-user data
|
|
|
|
|
/data/misc_de/[0-9]+/vold(/.*)? u:object_r:vold_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/vold(/.*)? u:object_r:vold_data_file:s0
|
|
|
|
|
|
2019-01-15 22:20:13 +01:00
|
|
|
# Backup service persistent per-user bookkeeping
|
|
|
|
|
/data/system_ce/[0-9]+/backup(/.*)? u:object_r:backup_data_file:s0
|
|
|
|
|
# Backup service temporary per-user data for inter-change with apps
|
|
|
|
|
/data/system_ce/[0-9]+/backup_stage(/.*)? u:object_r:backup_data_file:s0
|
|
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
#############################
|
|
|
|
|
# efs files
|
|
|
|
|
#
|
|
|
|
|
/efs(/.*)? u:object_r:efs_file:s0
|
2016-02-23 01:50:01 +01:00
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
#############################
|
|
|
|
|
# Cache files
|
|
|
|
|
#
|
|
|
|
|
/cache(/.*)? u:object_r:cache_file:s0
|
2015-12-22 21:37:17 +01:00
|
|
|
/cache/recovery(/.*)? u:object_r:cache_recovery_file:s0
|
2016-01-28 20:30:41 +01:00
|
|
|
# General backup/restore interchange with apps
|
|
|
|
|
/cache/backup_stage(/.*)? u:object_r:cache_backup_file:s0
|
|
|
|
|
# LocalTransport (backup) uses this subtree
|
|
|
|
|
/cache/backup(/.*)? u:object_r:cache_private_backup_file:s0
|
|
|
|
|
|
2018-06-13 17:02:29 +02:00
|
|
|
#############################
|
|
|
|
|
# Overlayfs support directories
|
|
|
|
|
#
|
|
|
|
|
/cache/overlay(/.*)? u:object_r:overlayfs_file:s0
|
2018-07-02 17:13:40 +02:00
|
|
|
/mnt/scratch(/.*)? u:object_r:overlayfs_file:s0
|
2018-06-13 17:02:29 +02:00
|
|
|
|
2016-05-14 00:22:44 +02:00
|
|
|
/data/cache(/.*)? u:object_r:cache_file:s0
|
|
|
|
|
/data/cache/recovery(/.*)? u:object_r:cache_recovery_file:s0
|
|
|
|
|
# General backup/restore interchange with apps
|
|
|
|
|
/data/cache/backup_stage(/.*)? u:object_r:cache_backup_file:s0
|
|
|
|
|
# LocalTransport (backup) uses this subtree
|
|
|
|
|
/data/cache/backup(/.*)? u:object_r:cache_private_backup_file:s0
|
|
|
|
|
|
2018-05-17 19:15:53 +02:00
|
|
|
#############################
|
|
|
|
|
# Metadata files
|
|
|
|
|
#
|
|
|
|
|
/metadata(/.*)? u:object_r:metadata_file:s0
|
2019-03-12 16:37:13 +01:00
|
|
|
/metadata/apex(/.*)? u:object_r:apex_metadata_file:s0
|
2018-05-17 19:15:53 +02:00
|
|
|
/metadata/vold(/.*)? u:object_r:vold_metadata_file:s0
|
2019-01-23 04:05:29 +01:00
|
|
|
/metadata/gsi(/.*)? u:object_r:gsi_metadata_file:s0
|
2021-03-22 06:46:12 +01:00
|
|
|
/metadata/gsi/dsu/active u:object_r:gsi_public_metadata_file:s0
|
|
|
|
|
/metadata/gsi/dsu/booted u:object_r:gsi_public_metadata_file:s0
|
|
|
|
|
/metadata/gsi/dsu/lp_names u:object_r:gsi_public_metadata_file:s0
|
|
|
|
|
/metadata/gsi/dsu/[^/]+/metadata_encryption_dir u:object_r:gsi_public_metadata_file:s0
|
2019-08-07 22:01:15 +02:00
|
|
|
/metadata/gsi/ota(/.*)? u:object_r:ota_metadata_file:s0
|
2019-02-28 23:11:34 +01:00
|
|
|
/metadata/password_slots(/.*)? u:object_r:password_slot_metadata_file:s0
|
2019-07-09 04:03:59 +02:00
|
|
|
/metadata/ota(/.*)? u:object_r:ota_metadata_file:s0
|
2019-05-23 21:49:42 +02:00
|
|
|
/metadata/bootstat(/.*)? u:object_r:metadata_bootstat_file:s0
|
2020-05-19 13:43:18 +02:00
|
|
|
/metadata/staged-install(/.*)? u:object_r:staged_install_file:s0
|
2020-06-02 11:47:16 +02:00
|
|
|
/metadata/userspacereboot(/.*)? u:object_r:userspace_reboot_metadata_file:s0
|
2020-12-05 18:25:35 +01:00
|
|
|
/metadata/watchdog(/.*)? u:object_r:watchdog_metadata_file:s0
|
2023-05-25 08:59:05 +02:00
|
|
|
/metadata/repair-mode(/.*)? u:object_r:repair_mode_metadata_file:s0
|
2024-02-13 04:18:32 +01:00
|
|
|
/metadata/aconfig(/.*)? u:object_r:aconfig_storage_metadata_file:s0
|
|
|
|
|
/metadata/aconfig/flags(/.*)? u:object_r:aconfig_storage_flags_metadata_file:s0
|
2018-05-17 19:15:53 +02:00
|
|
|
|
2017-07-27 21:23:00 +02:00
|
|
|
#############################
|
2012-07-30 20:20:40 +02:00
|
|
|
# asec containers
|
2014-07-07 19:58:53 +02:00
|
|
|
/mnt/asec(/.*)? u:object_r:asec_apk_file:s0
|
|
|
|
|
/mnt/asec/[^/]+/[^/]+\.zip u:object_r:asec_public_file:s0
|
|
|
|
|
/mnt/asec/[^/]+/lib(/.*)? u:object_r:asec_public_file:s0
|
|
|
|
|
/data/app-asec(/.*)? u:object_r:asec_image_file:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
|
|
|
|
|
#############################
|
|
|
|
|
# external storage
|
|
|
|
|
/mnt/media_rw(/.*)? u:object_r:mnt_media_rw_file:s0
|
|
|
|
|
/mnt/user(/.*)? u:object_r:mnt_user_file:s0
|
2020-01-13 21:42:37 +01:00
|
|
|
/mnt/pass_through(/.*)? u:object_r:mnt_pass_through_file:s0
|
2019-04-12 00:23:24 +02:00
|
|
|
/mnt/sdcard u:object_r:mnt_sdcard_file:s0
|
2015-08-06 20:52:45 +02:00
|
|
|
/mnt/runtime(/.*)? u:object_r:storage_file:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
/storage(/.*)? u:object_r:storage_file:s0
|
2018-04-11 05:49:45 +02:00
|
|
|
|
|
|
|
|
#############################
|
|
|
|
|
# mount point for read-write vendor partitions
|
2018-06-29 04:10:00 +02:00
|
|
|
/mnt/vendor(/.*)? u:object_r:mnt_vendor_file:s0
|
|
|
|
|
|
|
|
|
|
#############################
|
|
|
|
|
# mount point for read-write product partitions
|
|
|
|
|
/mnt/product(/.*)? u:object_r:mnt_product_file:s0
|
2021-03-11 20:26:08 +01:00
|
|
|
|
|
|
|
|
#############################
|
|
|
|
|
# /postinstall file contexts
|
|
|
|
|
/(system|product)/bin/check_dynamic_partitions u:object_r:postinstall_exec:s0
|
|
|
|
|
/(system|product)/bin/otapreopt_script u:object_r:postinstall_exec:s0
|
|
|
|
|
/(system|product)/bin/otapreopt u:object_r:postinstall_dexopt_exec:s0
|
