tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/sdcardd.te

26 lines
1,017 B
Text
Raw Normal View History

sdcard policy and fuse device label.
2012-05-31 15:44:51 +02:00
type sdcardd, domain;
type sdcardd_exec, exec_type, file_type;
init_daemon_domain(sdcardd)
Confine sdcardd, but leave it permissive for now. Change-Id: I1eba1535d650a09ee7640cb7f3664202be4a0a55 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
allow sdcardd cgroup:dir create_dir_perms;
allow sdcardd fuse_device:chr_file rw_file_perms;
allow sdcardd rootfs:dir mounton;
allow sdcardd sdcard_type:filesystem mount;
allow sdcardd self:capability { setuid setgid dac_override sys_admin sys_resource };
Label /data/media with its own type and allow access. /data/media presently is left in system_data_file, which requires anything that wants to write to it to be able to write to system_data_file. Introduce a new type for /data/media, media_rw_data_file (to match the media_rw UID assigned to it and distinguish it from /data/misc/media which has media UID and media_data_file type), and allow access to it. We allow this for all platform app domains as WRITE_MEDIA_STORAGE permission is granted to signature|system. We should not have to allow it to untrusted_app. Set up type transitions in sdcardd to automatically label any directories or files it creates with the new type. Change-Id: I5c7e6245b854a9213099e40a41d9583755d37d42 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-17 20:39:35 +01:00
Allow sdcardd to write to sdcard directory and file. Should resolve b/13060688 - emulator writes to /storage/sdcard failing. Change-Id: I9f00d9dfcd1c4f84c2320628257beca71abf170b Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-18 15:19:28 +01:00
allow sdcardd sdcard_type:dir create_dir_perms;
allow sdcardd sdcard_type:file create_file_perms;
Label /data/media with its own type and allow access. /data/media presently is left in system_data_file, which requires anything that wants to write to it to be able to write to system_data_file. Introduce a new type for /data/media, media_rw_data_file (to match the media_rw UID assigned to it and distinguish it from /data/misc/media which has media UID and media_data_file type), and allow access to it. We allow this for all platform app domains as WRITE_MEDIA_STORAGE permission is granted to signature|system. We should not have to allow it to untrusted_app. Set up type transitions in sdcardd to automatically label any directories or files it creates with the new type. Change-Id: I5c7e6245b854a9213099e40a41d9583755d37d42 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-17 20:39:35 +01:00
type_transition sdcardd system_data_file:{ dir file } media_rw_data_file;
allow sdcardd media_rw_data_file:dir create_dir_perms;
allow sdcardd media_rw_data_file:file create_file_perms;
Confine sdcardd, but leave it permissive for now. Change-Id: I1eba1535d650a09ee7640cb7f3664202be4a0a55 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
# Read /data/system/packages.list.
allow sdcardd system_data_file:file r_file_perms;
# Compatibility for existing devices with /data/media in system_data_file.
# TODO: Remove these lines after we have guaranteed that /data/media has been relabeled to media_rw_data_file.
allow sdcardd system_data_file:dir create_dir_perms;
allow sdcardd system_data_file:file create_file_perms;
Reference in a new issue Copy permalink