2012-01-04 18:33:27 +01:00
|
|
|
###########################################
|
|
|
|
|
# Root
|
2015-07-24 06:08:32 +02:00
|
|
|
/ u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
|
|
|
|
# Data files
|
2015-07-24 06:08:32 +02:00
|
|
|
/adb_keys u:object_r:adb_keys_file:s0
|
|
|
|
|
/build\.prop u:object_r:rootfs:s0
|
|
|
|
|
/default\.prop u:object_r:rootfs:s0
|
|
|
|
|
/fstab\..* u:object_r:rootfs:s0
|
|
|
|
|
/init\..* u:object_r:rootfs:s0
|
|
|
|
|
/res(/.*)? u:object_r:rootfs:s0
|
|
|
|
|
/selinux_version u:object_r:rootfs:s0
|
|
|
|
|
/ueventd\..* u:object_r:rootfs:s0
|
|
|
|
|
/verity_key u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
|
|
|
|
# Executables
|
2015-07-24 06:08:32 +02:00
|
|
|
/init u:object_r:init_exec:s0
|
|
|
|
|
/sbin(/.*)? u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
2017-03-02 09:02:29 +01:00
|
|
|
# For kernel modules
|
|
|
|
|
/lib(/.*)? u:object_r:rootfs:s0
|
|
|
|
|
|
2012-12-21 00:26:02 +01:00
|
|
|
# Empty directories
|
2015-07-24 06:08:32 +02:00
|
|
|
/lost\+found u:object_r:rootfs:s0
|
|
|
|
|
/acct u:object_r:cgroup:s0
|
|
|
|
|
/config u:object_r:rootfs:s0
|
2019-12-13 13:30:26 +01:00
|
|
|
/data_mirror u:object_r:mirror_data_file:s0
|
2019-04-16 09:13:22 +02:00
|
|
|
/debug_ramdisk u:object_r:tmpfs:s0
|
2015-07-24 06:08:32 +02:00
|
|
|
/mnt u:object_r:tmpfs:s0
|
2016-03-02 01:14:45 +01:00
|
|
|
/postinstall u:object_r:postinstall_mnt_dir:s0
|
2019-01-24 15:32:17 +01:00
|
|
|
/postinstall/apex u:object_r:postinstall_apex_mnt_dir:s0
|
2015-07-24 06:08:32 +02:00
|
|
|
/proc u:object_r:rootfs:s0
|
|
|
|
|
/sys u:object_r:sysfs:s0
|
2018-08-17 09:35:42 +02:00
|
|
|
/apex u:object_r:apex_mnt_dir:s0
|
2015-07-24 06:08:32 +02:00
|
|
|
|
|
|
|
|
# Symlinks
|
2017-12-06 21:03:45 +01:00
|
|
|
/bin u:object_r:rootfs:s0
|
2016-11-19 21:13:02 +01:00
|
|
|
/bugreports u:object_r:rootfs:s0
|
2018-09-08 00:05:33 +02:00
|
|
|
/charger u:object_r:rootfs:s0
|
2015-07-24 06:08:32 +02:00
|
|
|
/d u:object_r:rootfs:s0
|
|
|
|
|
/etc u:object_r:rootfs:s0
|
|
|
|
|
/sdcard u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
|
|
|
|
# SELinux policy files
|
2018-01-22 23:31:50 +01:00
|
|
|
/vendor_file_contexts u:object_r:file_contexts_file:s0
|
2017-03-24 23:02:13 +01:00
|
|
|
/nonplat_file_contexts u:object_r:file_contexts_file:s0
|
|
|
|
|
/plat_file_contexts u:object_r:file_contexts_file:s0
|
2018-12-19 04:51:19 +01:00
|
|
|
/product_file_contexts u:object_r:file_contexts_file:s0
|
2017-03-27 20:39:16 +02:00
|
|
|
/mapping_sepolicy\.cil u:object_r:sepolicy_file:s0
|
|
|
|
|
/nonplat_sepolicy\.cil u:object_r:sepolicy_file:s0
|
|
|
|
|
/plat_sepolicy\.cil u:object_r:sepolicy_file:s0
|
2017-03-24 18:22:14 +01:00
|
|
|
/plat_property_contexts u:object_r:property_contexts_file:s0
|
2018-12-21 04:31:42 +01:00
|
|
|
/product_property_contexts u:object_r:property_contexts_file:s0
|
2017-03-24 18:22:14 +01:00
|
|
|
/nonplat_property_contexts u:object_r:property_contexts_file:s0
|
2018-02-05 10:34:52 +01:00
|
|
|
/vendor_property_contexts u:object_r:property_contexts_file:s0
|
2017-03-27 19:57:07 +02:00
|
|
|
/seapp_contexts u:object_r:seapp_contexts_file:s0
|
|
|
|
|
/nonplat_seapp_contexts u:object_r:seapp_contexts_file:s0
|
2018-02-05 10:34:52 +01:00
|
|
|
/vendor_seapp_contexts u:object_r:seapp_contexts_file:s0
|
2017-03-27 19:57:07 +02:00
|
|
|
/plat_seapp_contexts u:object_r:seapp_contexts_file:s0
|
2017-03-27 20:39:16 +02:00
|
|
|
/sepolicy u:object_r:sepolicy_file:s0
|
2017-03-24 20:24:43 +01:00
|
|
|
/plat_service_contexts u:object_r:service_contexts_file:s0
|
2017-04-08 01:14:43 +02:00
|
|
|
/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
2017-09-26 21:58:29 +02:00
|
|
|
/nonplat_service_contexts u:object_r:nonplat_service_contexts_file:s0
|
2018-02-05 10:34:52 +01:00
|
|
|
# Use nonplat_service_contexts_file to allow servicemanager to read it
|
|
|
|
|
# on non full-treble devices.
|
|
|
|
|
/vendor_service_contexts u:object_r:nonplat_service_contexts_file:s0
|
2017-04-08 01:14:43 +02:00
|
|
|
/nonplat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
2018-02-05 10:34:52 +01:00
|
|
|
/vendor_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
2017-04-01 02:29:53 +02:00
|
|
|
/vndservice_contexts u:object_r:vndservice_contexts_file:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
##########################
|
|
|
|
|
# Devices
|
|
|
|
|
#
|
|
|
|
|
/dev(/.*)? u:object_r:device:s0
|
2014-06-04 02:01:10 +02:00
|
|
|
/dev/adf[0-9]* u:object_r:graphics_device:s0
|
|
|
|
|
/dev/adf-interface[0-9]*\.[0-9]* u:object_r:graphics_device:s0
|
|
|
|
|
/dev/adf-overlay-engine[0-9]*\.[0-9]* u:object_r:graphics_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/ashmem u:object_r:ashmem_device:s0
|
2019-09-24 23:43:00 +02:00
|
|
|
/dev/ashmem(.*)? u:object_r:ashmem_libcutils_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/audio.* u:object_r:audio_device:s0
|
|
|
|
|
/dev/binder u:object_r:binder_device:s0
|
|
|
|
|
/dev/block(/.*)? u:object_r:block_device:s0
|
2014-09-30 17:37:51 +02:00
|
|
|
/dev/block/dm-[0-9]+ u:object_r:dm_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/block/loop[0-9]* u:object_r:loop_device:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
/dev/block/vold/.+ u:object_r:vold_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/block/ram[0-9]* u:object_r:ram_device:s0
|
2015-08-25 21:06:39 +02:00
|
|
|
/dev/block/zram[0-9]* u:object_r:ram_device:s0
|
2019-08-28 23:08:50 +02:00
|
|
|
/dev/boringssl/selftest(/.*)? u:object_r:boringssl_self_test_marker:s0
|
2013-03-27 11:30:25 +01:00
|
|
|
/dev/bus/usb(.*)? u:object_r:usb_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/console u:object_r:console_device:s0
|
2018-11-06 00:03:16 +01:00
|
|
|
/dev/cpu_variant:.* u:object_r:dev_cpu_variant:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/device-mapper u:object_r:dm_device:s0
|
2012-04-03 21:30:28 +02:00
|
|
|
/dev/eac u:object_r:audio_device:s0
|
2016-11-08 00:11:39 +01:00
|
|
|
/dev/event-log-tags u:object_r:runtime_event_log_tags_file:s0
|
2019-01-11 02:10:31 +01:00
|
|
|
/dev/cgroup_info(/.*)? u:object_r:cgroup_rc_file:s0
|
2013-11-04 15:47:29 +01:00
|
|
|
/dev/fscklogs(/.*)? u:object_r:fscklogs:s0
|
2012-05-31 15:44:51 +02:00
|
|
|
/dev/fuse u:object_r:fuse_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/graphics(/.*)? u:object_r:graphics_device:s0
|
2013-10-03 22:35:56 +02:00
|
|
|
/dev/hw_random u:object_r:hw_random_device:s0
|
2016-05-24 15:15:23 +02:00
|
|
|
/dev/hwbinder u:object_r:hwbinder_device:s0
|
2017-09-26 21:58:29 +02:00
|
|
|
/dev/input(/.*)? u:object_r:input_device:s0
|
2013-01-30 19:17:14 +01:00
|
|
|
/dev/iio:device[0-9]+ u:object_r:iio_device:s0
|
2012-06-20 03:46:16 +02:00
|
|
|
/dev/ion u:object_r:ion_device:s0
|
2017-01-09 23:57:03 +01:00
|
|
|
/dev/keychord u:object_r:keychord_device:s0
|
2017-03-26 05:38:17 +02:00
|
|
|
/dev/loop-control u:object_r:loop_control_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/modem.* u:object_r:radio_device:s0
|
2012-01-06 16:25:53 +01:00
|
|
|
/dev/mtp_usb u:object_r:mtp_device:s0
|
2014-12-15 21:01:35 +01:00
|
|
|
/dev/pmsg0 u:object_r:pmsg_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/pn544 u:object_r:nfc_device:s0
|
2016-12-05 00:11:29 +01:00
|
|
|
/dev/port u:object_r:port_device:s0
|
2012-08-20 12:13:28 +02:00
|
|
|
/dev/ppp u:object_r:ppp_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/ptmx u:object_r:ptmx_device:s0
|
2014-01-16 14:47:34 +01:00
|
|
|
/dev/pvrsrvkm u:object_r:gpu_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/kmsg u:object_r:kmsg_device:s0
|
2017-03-28 22:09:37 +02:00
|
|
|
/dev/kmsg_debug u:object_r:kmsg_debug_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/null u:object_r:null_device:s0
|
|
|
|
|
/dev/nvhdcp1 u:object_r:video_device:s0
|
|
|
|
|
/dev/random u:object_r:random_device:s0
|
2012-07-11 20:21:05 +02:00
|
|
|
/dev/rpmsg-omx[0-9] u:object_r:rpmsg_device:s0
|
|
|
|
|
/dev/rproc_user u:object_r:rpmsg_device:s0
|
2015-05-21 19:03:16 +02:00
|
|
|
/dev/rtc[0-9] u:object_r:rtc_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/snd(/.*)? u:object_r:audio_device:s0
|
2013-12-02 15:02:22 +01:00
|
|
|
/dev/socket(/.*)? u:object_r:socket_device:s0
|
2012-11-16 15:06:47 +01:00
|
|
|
/dev/socket/adbd u:object_r:adbd_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/socket/dnsproxyd u:object_r:dnsproxyd_socket:s0
|
2013-12-14 07:19:45 +01:00
|
|
|
/dev/socket/dumpstate u:object_r:dumpstate_socket:s0
|
2014-05-01 20:12:10 +02:00
|
|
|
/dev/socket/fwmarkd u:object_r:fwmarkd_socket:s0
|
2013-12-06 01:55:34 +01:00
|
|
|
/dev/socket/lmkd u:object_r:lmkd_socket:s0
|
2013-11-13 00:34:52 +01:00
|
|
|
/dev/socket/logd u:object_r:logd_socket:s0
|
|
|
|
|
/dev/socket/logdr u:object_r:logdr_socket:s0
|
|
|
|
|
/dev/socket/logdw u:object_r:logdw_socket:s0
|
2018-04-20 20:07:22 +02:00
|
|
|
/dev/socket/statsdw u:object_r:statsdw_socket:s0
|
2013-09-19 21:09:38 +02:00
|
|
|
/dev/socket/mdns u:object_r:mdns_socket:s0
|
2014-02-24 19:04:49 +01:00
|
|
|
/dev/socket/mdnsd u:object_r:mdnsd_socket:s0
|
2014-03-05 15:50:08 +01:00
|
|
|
/dev/socket/mtpd u:object_r:mtpd_socket:s0
|
2017-05-01 22:01:44 +02:00
|
|
|
/dev/socket/pdx/system/buffer_hub u:object_r:pdx_bufferhub_dir:s0
|
|
|
|
|
/dev/socket/pdx/system/buffer_hub/client u:object_r:pdx_bufferhub_client_endpoint_socket:s0
|
|
|
|
|
/dev/socket/pdx/system/performance u:object_r:pdx_performance_dir:s0
|
|
|
|
|
/dev/socket/pdx/system/performance/client u:object_r:pdx_performance_client_endpoint_socket:s0
|
|
|
|
|
/dev/socket/pdx/system/vr/display u:object_r:pdx_display_dir:s0
|
|
|
|
|
/dev/socket/pdx/system/vr/display/client u:object_r:pdx_display_client_endpoint_socket:s0
|
|
|
|
|
/dev/socket/pdx/system/vr/display/manager u:object_r:pdx_display_manager_endpoint_socket:s0
|
|
|
|
|
/dev/socket/pdx/system/vr/display/screenshot u:object_r:pdx_display_screenshot_endpoint_socket:s0
|
|
|
|
|
/dev/socket/pdx/system/vr/display/vsync u:object_r:pdx_display_vsync_endpoint_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/socket/property_service u:object_r:property_socket:s0
|
2013-01-07 15:21:18 +01:00
|
|
|
/dev/socket/racoon u:object_r:racoon_socket:s0
|
2018-05-29 19:54:16 +02:00
|
|
|
/dev/socket/recovery u:object_r:recovery_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/socket/rild u:object_r:rild_socket:s0
|
|
|
|
|
/dev/socket/rild-debug u:object_r:rild_debug_socket:s0
|
2016-10-19 23:39:30 +02:00
|
|
|
/dev/socket/tombstoned_crash u:object_r:tombstoned_crash_socket:s0
|
2017-05-15 19:39:16 +02:00
|
|
|
/dev/socket/tombstoned_java_trace u:object_r:tombstoned_java_trace_socket:s0
|
2016-10-19 23:39:30 +02:00
|
|
|
/dev/socket/tombstoned_intercept u:object_r:tombstoned_intercept_socket:s0
|
2017-12-21 03:51:15 +01:00
|
|
|
/dev/socket/traced_consumer u:object_r:traced_consumer_socket:s0
|
2020-01-22 20:16:13 +01:00
|
|
|
/dev/socket/traced_perf u:object_r:traced_perf_socket:s0
|
|
|
|
|
/dev/socket/traced_producer u:object_r:traced_producer_socket:s0
|
2018-10-15 19:02:02 +02:00
|
|
|
/dev/socket/heapprofd u:object_r:heapprofd_socket:s0
|
2016-02-26 19:30:12 +01:00
|
|
|
/dev/socket/uncrypt u:object_r:uncrypt_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/socket/wpa_eth[0-9] u:object_r:wpa_socket:s0
|
|
|
|
|
/dev/socket/wpa_wlan[0-9] u:object_r:wpa_socket:s0
|
|
|
|
|
/dev/socket/zygote u:object_r:zygote_socket:s0
|
2014-05-23 01:48:20 +02:00
|
|
|
/dev/socket/zygote_secondary u:object_r:zygote_socket:s0
|
2019-02-23 00:42:25 +01:00
|
|
|
/dev/socket/usap_pool_primary u:object_r:zygote_socket:s0
|
|
|
|
|
/dev/socket/usap_pool_secondary u:object_r:zygote_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/spdif_out.* u:object_r:audio_device:s0
|
2013-04-05 20:22:27 +02:00
|
|
|
/dev/tty u:object_r:owntty_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/tty[0-9]* u:object_r:tty_device:s0
|
|
|
|
|
/dev/ttyS[0-9]* u:object_r:serial_device:s0
|
2019-11-14 18:32:32 +01:00
|
|
|
/dev/ttyUSB[0-9]* u:object_r:usb_serial_device:s0
|
|
|
|
|
/dev/ttyACM[0-9]* u:object_r:usb_serial_device:s0
|
2013-01-07 15:21:18 +01:00
|
|
|
/dev/tun u:object_r:tun_device:s0
|
|
|
|
|
/dev/uhid u:object_r:uhid_device:s0
|
2013-10-23 19:50:19 +02:00
|
|
|
/dev/uinput u:object_r:uhid_device:s0
|
2014-03-26 20:37:54 +01:00
|
|
|
/dev/uio[0-9]* u:object_r:uio_device:s0
|
2016-11-19 21:52:54 +01:00
|
|
|
/dev/urandom u:object_r:random_device:s0
|
2013-01-30 19:17:14 +01:00
|
|
|
/dev/usb_accessory u:object_r:usbaccessory_device:s0
|
2017-12-23 02:17:06 +01:00
|
|
|
/dev/v4l-touch[0-9]* u:object_r:input_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/video[0-9]* u:object_r:video_device:s0
|
2017-03-22 00:01:52 +01:00
|
|
|
/dev/vndbinder u:object_r:vndbinder_device:s0
|
2012-12-03 12:07:45 +01:00
|
|
|
/dev/watchdog u:object_r:watchdog_device:s0
|
2012-07-19 20:07:04 +02:00
|
|
|
/dev/xt_qtaguid u:object_r:qtaguid_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/zero u:object_r:zero_device:s0
|
2013-03-01 02:33:16 +01:00
|
|
|
/dev/__properties__ u:object_r:properties_device:s0
|
2017-11-16 23:25:02 +01:00
|
|
|
/dev/__properties__/property_info u:object_r:property_info:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
#############################
|
2019-11-22 06:56:10 +01:00
|
|
|
# Linker configuration
|
|
|
|
|
#
|
|
|
|
|
/linkerconfig(/.*)? u:object_r:linkerconfig_file:s0
|
|
|
|
|
#############################
|
2012-01-04 18:33:27 +01:00
|
|
|
# System files
|
|
|
|
|
#
|
|
|
|
|
/system(/.*)? u:object_r:system_file:s0
|
2019-07-17 16:48:30 +02:00
|
|
|
/system/apex/com.android.art u:object_r:art_apex_dir:s0
|
2018-08-12 00:34:49 +02:00
|
|
|
/system/lib(64)?(/.*)? u:object_r:system_lib_file:s0
|
2019-03-14 18:45:33 +01:00
|
|
|
/system/lib(64)?/bootstrap(/.*)? u:object_r:system_bootstrap_lib_file:s0
|
2015-06-24 08:24:17 +02:00
|
|
|
/system/bin/atrace u:object_r:atrace_exec:s0
|
2019-04-09 19:57:13 +02:00
|
|
|
/system/bin/auditctl u:object_r:auditctl_exec:s0
|
2018-12-12 18:06:05 +01:00
|
|
|
/system/bin/bcc u:object_r:rs_exec:s0
|
2018-01-19 22:00:42 +01:00
|
|
|
/system/bin/blank_screen u:object_r:blank_screen_exec:s0
|
2019-08-28 23:08:50 +02:00
|
|
|
/system/bin/boringssl_self_test(32|64) u:object_r:boringssl_self_test_exec:s0
|
2018-09-08 00:05:33 +02:00
|
|
|
/system/bin/charger u:object_r:charger_exec:s0
|
2017-06-07 02:27:44 +02:00
|
|
|
/system/bin/e2fsdroid u:object_r:e2fs_exec:s0
|
|
|
|
|
/system/bin/mke2fs u:object_r:e2fs_exec:s0
|
2014-09-23 15:11:30 +02:00
|
|
|
/system/bin/e2fsck -- u:object_r:fsck_exec:s0
|
2018-05-22 15:53:42 +02:00
|
|
|
/system/bin/fsck\.exfat -- u:object_r:fsck_exec:s0
|
2014-10-20 19:36:49 +02:00
|
|
|
/system/bin/fsck\.f2fs -- u:object_r:fsck_exec:s0
|
2018-09-08 00:05:33 +02:00
|
|
|
/system/bin/init u:object_r:init_exec:s0
|
2019-03-15 19:15:31 +01:00
|
|
|
# TODO(/123600489): merge mini-keyctl into toybox
|
|
|
|
|
/system/bin/mini-keyctl -- u:object_r:toolbox_exec:s0
|
|
|
|
|
/system/bin/fsverity_init u:object_r:fsverity_init_exec:s0
|
2017-11-29 04:39:10 +01:00
|
|
|
/system/bin/sload_f2fs -- u:object_r:e2fs_exec:s0
|
2017-11-27 19:13:33 +01:00
|
|
|
/system/bin/make_f2fs -- u:object_r:e2fs_exec:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
/system/bin/fsck_msdos -- u:object_r:fsck_exec:s0
|
2018-10-11 19:49:59 +02:00
|
|
|
/system/bin/tcpdump -- u:object_r:tcpdump_exec:s0
|
2016-07-22 08:18:47 +02:00
|
|
|
/system/bin/tune2fs -- u:object_r:fsck_exec:s0
|
2014-09-23 15:11:30 +02:00
|
|
|
/system/bin/toolbox -- u:object_r:toolbox_exec:s0
|
2014-12-18 01:03:01 +01:00
|
|
|
/system/bin/toybox -- u:object_r:toolbox_exec:s0
|
2018-12-12 18:06:05 +01:00
|
|
|
/system/bin/ld\.mc u:object_r:rs_exec:s0
|
2014-09-04 14:44:49 +02:00
|
|
|
/system/bin/logcat -- u:object_r:logcat_exec:s0
|
2017-04-03 21:38:30 +02:00
|
|
|
/system/bin/logcatd -- u:object_r:logcat_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/sh -- u:object_r:shell_exec:s0
|
2012-11-13 19:00:05 +01:00
|
|
|
/system/bin/run-as -- u:object_r:runas_exec:s0
|
2013-12-11 21:17:53 +01:00
|
|
|
/system/bin/bootanimation u:object_r:bootanim_exec:s0
|
2016-01-26 01:23:10 +01:00
|
|
|
/system/bin/bootstat u:object_r:bootstat_exec:s0
|
2014-05-14 18:13:24 +02:00
|
|
|
/system/bin/app_process32 u:object_r:zygote_exec:s0
|
2014-04-04 18:45:57 +02:00
|
|
|
/system/bin/app_process64 u:object_r:zygote_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/servicemanager u:object_r:servicemanager_exec:s0
|
2016-05-24 15:15:23 +02:00
|
|
|
/system/bin/hwservicemanager u:object_r:hwservicemanager_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/surfaceflinger u:object_r:surfaceflinger_exec:s0
|
2018-11-01 21:47:51 +01:00
|
|
|
/system/bin/gpuservice u:object_r:gpuservice_exec:s0
|
2017-02-10 00:15:11 +01:00
|
|
|
/system/bin/bufferhubd u:object_r:bufferhubd_exec:s0
|
|
|
|
|
/system/bin/performanced u:object_r:performanced_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/drmserver u:object_r:drmserver_exec:s0
|
2013-12-14 07:19:45 +01:00
|
|
|
/system/bin/dumpstate u:object_r:dumpstate_exec:s0
|
2016-11-21 08:23:04 +01:00
|
|
|
/system/bin/incident u:object_r:incident_exec:s0
|
|
|
|
|
/system/bin/incidentd u:object_r:incidentd_exec:s0
|
2018-01-22 23:00:46 +01:00
|
|
|
/system/bin/incident_helper u:object_r:incident_helper_exec:s0
|
2018-11-09 22:09:24 +01:00
|
|
|
/system/bin/iw u:object_r:iw_exec:s0
|
2017-04-15 04:06:56 +02:00
|
|
|
/system/bin/netutils-wrapper-1\.0 u:object_r:netutils_wrapper_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/vold u:object_r:vold_exec:s0
|
|
|
|
|
/system/bin/netd u:object_r:netd_exec:s0
|
2016-05-20 04:31:20 +02:00
|
|
|
/system/bin/wificond u:object_r:wificond_exec:s0
|
2015-09-09 19:48:04 +02:00
|
|
|
/system/bin/audioserver u:object_r:audioserver_exec:s0
|
2016-02-12 18:05:42 +01:00
|
|
|
/system/bin/mediadrmserver u:object_r:mediadrmserver_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/mediaserver u:object_r:mediaserver_exec:s0
|
2017-01-24 21:53:45 +01:00
|
|
|
/system/bin/mediametrics u:object_r:mediametrics_exec:s0
|
2015-12-04 01:10:05 +01:00
|
|
|
/system/bin/cameraserver u:object_r:cameraserver_exec:s0
|
2015-09-22 19:56:03 +02:00
|
|
|
/system/bin/mediaextractor u:object_r:mediaextractor_exec:s0
|
2018-09-20 21:07:44 +02:00
|
|
|
/system/bin/mediaswcodec u:object_r:mediaswcodec_exec:s0
|
2019-11-28 03:10:01 +01:00
|
|
|
/system/bin/mediatranscoding u:object_r:mediatranscoding_exec:s0
|
2014-02-24 19:04:49 +01:00
|
|
|
/system/bin/mdnsd u:object_r:mdnsd_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/installd u:object_r:installd_exec:s0
|
2016-03-30 00:08:20 +02:00
|
|
|
/system/bin/otapreopt_chroot u:object_r:otapreopt_chroot_exec:s0
|
2016-07-09 20:57:13 +02:00
|
|
|
/system/bin/otapreopt_slot u:object_r:otapreopt_slot_exec:s0
|
2019-03-04 23:10:02 +01:00
|
|
|
/system/bin/art_apex_boot_integrity u:object_r:art_apex_boot_integrity_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/keystore u:object_r:keystore_exec:s0
|
2015-05-13 00:16:06 +02:00
|
|
|
/system/bin/fingerprintd u:object_r:fingerprintd_exec:s0
|
2015-04-04 01:46:33 +02:00
|
|
|
/system/bin/gatekeeperd u:object_r:gatekeeperd_exec:s0
|
2016-10-19 23:39:30 +02:00
|
|
|
/system/bin/crash_dump32 u:object_r:crash_dump_exec:s0
|
|
|
|
|
/system/bin/crash_dump64 u:object_r:crash_dump_exec:s0
|
|
|
|
|
/system/bin/tombstoned u:object_r:tombstoned_exec:s0
|
2016-03-16 16:11:49 +01:00
|
|
|
/system/bin/recovery-persist u:object_r:recovery_persist_exec:s0
|
|
|
|
|
/system/bin/recovery-refresh u:object_r:recovery_refresh_exec:s0
|
2012-05-31 15:44:51 +02:00
|
|
|
/system/bin/sdcard u:object_r:sdcardd_exec:s0
|
2019-09-21 00:14:23 +02:00
|
|
|
/system/bin/snapshotctl u:object_r:snapshotctl_exec:s0
|
2012-08-15 12:25:14 +02:00
|
|
|
/system/bin/dhcpcd u:object_r:dhcp_exec:s0
|
2018-10-24 15:50:22 +02:00
|
|
|
/system/bin/dhcpcd-6\.8\.2 u:object_r:dhcp_exec:s0
|
2012-08-20 12:13:28 +02:00
|
|
|
/system/bin/mtpd u:object_r:mtp_exec:s0
|
|
|
|
|
/system/bin/pppd u:object_r:ppp_exec:s0
|
2013-01-07 15:21:18 +01:00
|
|
|
/system/bin/racoon u:object_r:racoon_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/xbin/su u:object_r:su_exec:s0
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
/system/bin/dnsmasq u:object_r:dnsmasq_exec:s0
|
2016-11-01 21:49:10 +01:00
|
|
|
/system/bin/healthd u:object_r:healthd_exec:s0
|
2013-08-05 08:32:56 +02:00
|
|
|
/system/bin/clatd u:object_r:clatd_exec:s0
|
2018-09-25 01:12:23 +02:00
|
|
|
/system/bin/linker(64)? u:object_r:system_linker_exec:s0
|
2019-07-08 12:02:05 +02:00
|
|
|
/system/bin/linkerconfig u:object_r:linkerconfig_exec:s0
|
2019-01-16 15:35:34 +01:00
|
|
|
/system/bin/bootstrap/linker(64)? u:object_r:system_linker_exec:s0
|
2018-02-20 20:02:39 +01:00
|
|
|
/system/bin/llkd u:object_r:llkd_exec:s0
|
2013-12-06 01:55:34 +01:00
|
|
|
/system/bin/lmkd u:object_r:lmkd_exec:s0
|
2017-12-03 23:23:16 +01:00
|
|
|
/system/bin/usbd u:object_r:usbd_exec:s0
|
2013-12-15 21:50:00 +01:00
|
|
|
/system/bin/inputflinger u:object_r:inputflinger_exec:s0
|
2013-11-13 00:34:52 +01:00
|
|
|
/system/bin/logd u:object_r:logd_exec:s0
|
2019-03-14 23:45:03 +01:00
|
|
|
/system/bin/lpdumpd u:object_r:lpdumpd_exec:s0
|
2018-11-15 14:04:13 +01:00
|
|
|
/system/bin/rss_hwm_reset u:object_r:rss_hwm_reset_exec:s0
|
2018-01-24 17:07:09 +01:00
|
|
|
/system/bin/perfetto u:object_r:perfetto_exec:s0
|
2017-12-21 03:51:15 +01:00
|
|
|
/system/bin/traced u:object_r:traced_exec:s0
|
2020-01-22 20:16:13 +01:00
|
|
|
/system/bin/traced_perf u:object_r:traced_perf_exec:s0
|
2017-12-21 03:51:15 +01:00
|
|
|
/system/bin/traced_probes u:object_r:traced_probes_exec:s0
|
2018-10-15 19:02:02 +02:00
|
|
|
/system/bin/heapprofd u:object_r:heapprofd_exec:s0
|
2014-02-19 22:33:32 +01:00
|
|
|
/system/bin/uncrypt u:object_r:uncrypt_exec:s0
|
2015-12-05 02:48:50 +01:00
|
|
|
/system/bin/update_verifier u:object_r:update_verifier_exec:s0
|
2014-06-17 17:49:17 +02:00
|
|
|
/system/bin/logwrapper u:object_r:system_file:s0
|
2014-06-21 03:11:11 +02:00
|
|
|
/system/bin/vdc u:object_r:vdc_exec:s0
|
2018-10-24 15:50:22 +02:00
|
|
|
/system/bin/cppreopts\.sh u:object_r:cppreopts_exec:s0
|
|
|
|
|
/system/bin/preloads_copy\.sh u:object_r:preloads_copy_exec:s0
|
2016-06-23 00:47:09 +02:00
|
|
|
/system/bin/preopt2cachename u:object_r:preopt2cachename_exec:s0
|
2016-08-26 04:36:49 +02:00
|
|
|
/system/bin/dex2oat(d)? u:object_r:dex2oat_exec:s0
|
2017-07-25 04:35:35 +02:00
|
|
|
/system/bin/dexoptanalyzer(d)? u:object_r:dexoptanalyzer_exec:s0
|
2019-01-11 17:13:01 +01:00
|
|
|
/system/bin/viewcompiler u:object_r:viewcompiler_exec:s0
|
2017-07-25 04:35:35 +02:00
|
|
|
/system/bin/profman(d)? u:object_r:profman_exec:s0
|
2018-10-05 23:48:29 +02:00
|
|
|
/system/bin/iorapd u:object_r:iorapd_exec:s0
|
2019-09-19 20:04:20 +02:00
|
|
|
/system/bin/iorap\.prefetcherd u:object_r:iorap_prefetcherd_exec:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
/system/bin/sgdisk u:object_r:sgdisk_exec:s0
|
|
|
|
|
/system/bin/blkid u:object_r:blkid_exec:s0
|
2015-04-07 14:35:21 +02:00
|
|
|
/system/bin/tzdatacheck u:object_r:tzdatacheck_exec:s0
|
2018-10-26 05:09:55 +02:00
|
|
|
/system/bin/flags_health_check -- u:object_r:flags_health_check_exec:s0
|
2015-06-19 19:47:26 +02:00
|
|
|
/system/bin/idmap u:object_r:idmap_exec:s0
|
2018-06-15 08:08:19 +02:00
|
|
|
/system/bin/idmap2(d)? u:object_r:idmap_exec:s0
|
2015-10-05 23:04:39 +02:00
|
|
|
/system/bin/update_engine u:object_r:update_engine_exec:s0
|
2016-06-18 00:05:10 +02:00
|
|
|
/system/bin/storaged u:object_r:storaged_exec:s0
|
2017-08-04 23:51:36 +02:00
|
|
|
/system/bin/wpantund u:object_r:wpantund_exec:s0
|
2017-02-10 00:15:11 +01:00
|
|
|
/system/bin/virtual_touchpad u:object_r:virtual_touchpad_exec:s0
|
2018-10-21 03:33:41 +02:00
|
|
|
/system/bin/hw/android\.frameworks\.bufferhub@1\.0-service u:object_r:fwk_bufferhub_exec:s0
|
2017-03-18 00:51:56 +01:00
|
|
|
/system/bin/hw/android\.hidl\.allocator@1\.0-service u:object_r:hal_allocator_default_exec:s0
|
2019-02-27 01:45:40 +01:00
|
|
|
/system/bin/hw/android\.system\.suspend@1\.0-service u:object_r:system_suspend_exec:s0
|
2019-01-11 02:10:31 +01:00
|
|
|
/system/etc/cgroups\.json u:object_r:cgroup_desc_file:s0
|
2019-01-10 22:59:37 +01:00
|
|
|
/system/etc/event-log-tags u:object_r:system_event_log_tags_file:s0
|
2019-07-15 22:33:48 +02:00
|
|
|
/system/etc/group u:object_r:system_group_file:s0
|
2018-08-12 00:34:49 +02:00
|
|
|
/system/etc/ld\.config.* u:object_r:system_linker_config_file:s0
|
2019-07-15 22:33:48 +02:00
|
|
|
/system/etc/passwd u:object_r:system_passwd_file:s0
|
2018-08-12 00:34:49 +02:00
|
|
|
/system/etc/seccomp_policy(/.*)? u:object_r:system_seccomp_policy_file:s0
|
|
|
|
|
/system/etc/security/cacerts(/.*)? u:object_r:system_security_cacerts_file:s0
|
2017-04-10 21:27:18 +02:00
|
|
|
/system/etc/selinux/mapping/[0-9]+\.[0-9]+\.cil u:object_r:sepolicy_file:s0
|
|
|
|
|
/system/etc/selinux/plat_mac_permissions\.xml u:object_r:mac_perms_file:s0
|
2017-03-24 18:22:14 +01:00
|
|
|
/system/etc/selinux/plat_property_contexts u:object_r:property_contexts_file:s0
|
2017-03-24 20:24:43 +01:00
|
|
|
/system/etc/selinux/plat_service_contexts u:object_r:service_contexts_file:s0
|
2017-04-08 01:14:43 +02:00
|
|
|
/system/etc/selinux/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
2017-03-24 23:02:13 +01:00
|
|
|
/system/etc/selinux/plat_file_contexts u:object_r:file_contexts_file:s0
|
2017-03-27 19:57:07 +02:00
|
|
|
/system/etc/selinux/plat_seapp_contexts u:object_r:seapp_contexts_file:s0
|
2018-10-24 15:50:22 +02:00
|
|
|
/system/etc/selinux/plat_sepolicy\.cil u:object_r:sepolicy_file:s0
|
2017-04-10 21:27:18 +02:00
|
|
|
/system/etc/selinux/plat_and_mapping_sepolicy\.cil\.sha256 u:object_r:sepolicy_file:s0
|
2019-01-11 02:10:31 +01:00
|
|
|
/system/etc/task_profiles\.json u:object_r:task_profiles_file:s0
|
2018-09-27 17:45:16 +02:00
|
|
|
/system/usr/share/zoneinfo(/.*)? u:object_r:system_zoneinfo_file:s0
|
2017-03-14 21:26:17 +01:00
|
|
|
/system/bin/vr_hwc u:object_r:vr_hwc_exec:s0
|
2017-07-31 12:38:28 +02:00
|
|
|
/system/bin/adbd u:object_r:adbd_exec:s0
|
2017-10-13 23:54:32 +02:00
|
|
|
/system/bin/vold_prepare_subdirs u:object_r:vold_prepare_subdirs_exec:s0
|
2017-12-19 00:14:33 +01:00
|
|
|
/system/bin/stats u:object_r:stats_exec:s0
|
|
|
|
|
/system/bin/statsd u:object_r:statsd_exec:s0
|
2018-01-03 00:31:18 +01:00
|
|
|
/system/bin/bpfloader u:object_r:bpfloader_exec:s0
|
2018-05-09 00:45:38 +02:00
|
|
|
/system/bin/wait_for_keymaster u:object_r:wait_for_keymaster_exec:s0
|
2018-08-02 00:48:20 +02:00
|
|
|
/system/bin/watchdogd u:object_r:watchdogd_exec:s0
|
2018-08-17 09:35:42 +02:00
|
|
|
/system/bin/apexd u:object_r:apexd_exec:s0
|
2019-01-14 23:38:17 +01:00
|
|
|
/system/bin/gsid u:object_r:gsid_exec:s0
|
2020-01-10 20:02:43 +01:00
|
|
|
/system/bin/simpleperf u:object_r:simpleperf_exec:s0
|
2019-01-11 00:34:08 +01:00
|
|
|
/system/bin/simpleperf_app_runner u:object_r:simpleperf_app_runner_exec:s0
|
2019-02-05 23:21:01 +01:00
|
|
|
/system/bin/notify_traceur\.sh u:object_r:notify_traceur_exec:s0
|
2019-05-17 16:05:18 +02:00
|
|
|
/system/bin/migrate_legacy_obb_data\.sh u:object_r:migrate_legacy_obb_data_exec:s0
|
2020-01-04 01:32:07 +01:00
|
|
|
/system/bin/aidl_lazy_test_server u:object_r:aidl_lazy_test_server_exec:s0
|
2019-11-13 20:25:55 +01:00
|
|
|
/system/bin/android\.frameworks\.automotive\.display@1\.0-service u:object_r:automotive_display_exec:s0
|
2014-07-03 01:18:16 +02:00
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
#############################
|
2013-03-20 20:03:04 +01:00
|
|
|
# Vendor files
|
|
|
|
|
#
|
2017-04-02 02:17:12 +02:00
|
|
|
/(vendor|system/vendor)(/.*)? u:object_r:vendor_file:s0
|
2017-04-13 22:06:00 +02:00
|
|
|
/(vendor|system/vendor)/bin/sh u:object_r:vendor_shell_exec:s0
|
2017-04-13 00:19:12 +02:00
|
|
|
/(vendor|system/vendor)/bin/toybox_vendor u:object_r:vendor_toolbox_exec:s0
|
2018-01-11 21:53:09 +01:00
|
|
|
/(vendor|system/vendor)/bin/toolbox u:object_r:vendor_toolbox_exec:s0
|
2017-04-02 02:17:12 +02:00
|
|
|
/(vendor|system/vendor)/etc(/.*)? u:object_r:vendor_configs_file:s0
|
2019-02-20 00:02:14 +01:00
|
|
|
/(vendor|system/vendor)/etc/cgroups\.json u:object_r:vendor_cgroup_desc_file:s0
|
|
|
|
|
/(vendor|system/vendor)/etc/task_profiles\.json u:object_r:vendor_task_profiles_file:s0
|
2017-04-02 02:17:12 +02:00
|
|
|
|
|
|
|
|
/(vendor|system/vendor)/lib(64)?/egl(/.*)? u:object_r:same_process_hal_file:s0
|
|
|
|
|
|
2017-04-10 06:37:40 +02:00
|
|
|
/(vendor|system/vendor)/lib(64)?/vndk-sp(/.*)? u:object_r:vndk_sp_file:s0
|
2017-04-07 14:16:19 +02:00
|
|
|
|
2018-10-24 15:50:22 +02:00
|
|
|
/(vendor|system/vendor)/manifest\.xml u:object_r:vendor_configs_file:s0
|
|
|
|
|
/(vendor|system/vendor)/compatibility_matrix\.xml u:object_r:vendor_configs_file:s0
|
2018-01-19 02:53:35 +01:00
|
|
|
/(vendor|system/vendor)/etc/vintf(/.*)? u:object_r:vendor_configs_file:s0
|
2017-04-02 02:17:12 +02:00
|
|
|
/(vendor|system/vendor)/app(/.*)? u:object_r:vendor_app_file:s0
|
2017-11-20 13:09:55 +01:00
|
|
|
/(vendor|system/vendor)/priv-app(/.*)? u:object_r:vendor_app_file:s0
|
2017-04-02 02:17:12 +02:00
|
|
|
/(vendor|system/vendor)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
|
|
|
|
|
/(vendor|system/vendor)/framework(/.*)? u:object_r:vendor_framework_file:s0
|
|
|
|
|
|
2019-10-03 22:30:28 +02:00
|
|
|
/(vendor|system/vendor)/apex(/[^/]+){0,2} u:object_r:vendor_apex_file:s0
|
|
|
|
|
/(vendor|system/vendor)/bin/misc_writer u:object_r:vendor_misc_writer_exec:s0
|
|
|
|
|
/(vendor|system/vendor)/bin/boringssl_self_test(32|64) u:object_r:vendor_boringssl_self_test_exec:s0
|
2019-04-24 03:45:40 +02:00
|
|
|
|
2017-04-02 02:17:12 +02:00
|
|
|
# HAL location
|
|
|
|
|
/(vendor|system/vendor)/lib(64)?/hw u:object_r:vendor_hal_file:s0
|
|
|
|
|
|
2019-10-02 00:23:25 +02:00
|
|
|
/(vendor|system/vendor)/etc/selinux/(vendor|nonplat)_service_contexts u:object_r:nonplat_service_contexts_file:s0
|
|
|
|
|
|
Moving recovery resources from /system to /vendor
This change is part of a topic that moves the recovery resources from the
system partition to the vendor partition, if it exists, or the vendor directory
on the system partition otherwise. The recovery resources are moving from the
system image to the vendor partition so that a single system image may be used
with either an A/B or a non-A/B vendor image. The topic removes a delta in the
system image that prevented such reuse in the past.
The recovery resources that are moving are involved with updating the recovery
partition after an update. In a non-A/B configuration, the system boots from
the recovery partition, updates the other partitions (system, vendor, etc.)
Then, the next time the system boots normally, a script updates the recovery
partition (if necessary). This script, the executables it invokes, and the data
files that it uses were previously on the system partition. The resources that
are moving include the following.
* install-recovery.sh
* applypatch
* recovery-resource.dat (if present)
* recovery-from-boot.p (if present)
This change includes the sepolicy changes to move the recovery resources from
system to vendor. The big change is renaming install_recovery*.te to
vendor_install_recovery*.te to emphasize the move to vendor. Other changes
follow from that. The net result is that the application of the recovery patch
has the same permissions that it had when it lived in system.
Bug: 68319577
Test: Ensure that recovery partition is updated correctly.
Change-Id: If29cb22b2a7a5ce1b25d45ef8635e6cb81103327
2019-09-18 01:59:42 +02:00
|
|
|
/(vendor|system/vendor)/bin/install-recovery\.sh u:object_r:vendor_install_recovery_exec:s0
|
|
|
|
|
|
2015-03-18 21:11:11 +01:00
|
|
|
#############################
|
2015-05-07 01:33:56 +02:00
|
|
|
# OEM and ODM files
|
2015-03-18 21:11:11 +01:00
|
|
|
#
|
2018-03-07 18:53:45 +01:00
|
|
|
/(odm|vendor/odm)(/.*)? u:object_r:vendor_file:s0
|
|
|
|
|
/(odm|vendor/odm)/lib(64)?/egl(/.*)? u:object_r:same_process_hal_file:s0
|
|
|
|
|
/(odm|vendor/odm)/lib(64)?/hw u:object_r:vendor_hal_file:s0
|
|
|
|
|
/(odm|vendor/odm)/lib(64)?/vndk-sp(/.*)? u:object_r:vndk_sp_file:s0
|
|
|
|
|
/(odm|vendor/odm)/bin/sh u:object_r:vendor_shell_exec:s0
|
|
|
|
|
/(odm|vendor/odm)/etc(/.*)? u:object_r:vendor_configs_file:s0
|
|
|
|
|
/(odm|vendor/odm)/app(/.*)? u:object_r:vendor_app_file:s0
|
|
|
|
|
/(odm|vendor/odm)/priv-app(/.*)? u:object_r:vendor_app_file:s0
|
|
|
|
|
/(odm|vendor/odm)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
|
|
|
|
|
/(odm|vendor/odm)/framework(/.*)? u:object_r:vendor_framework_file:s0
|
2017-12-13 03:54:59 +01:00
|
|
|
|
2018-10-08 21:04:15 +02:00
|
|
|
# Input configuration
|
2019-10-03 22:30:28 +02:00
|
|
|
/(odm|vendor/odm|vendor|system/vendor)/usr/keylayout(/.*)?\.kl u:object_r:vendor_keylayout_file:s0
|
|
|
|
|
/(odm|vendor/odm|vendor|system/vendor)/usr/keychars(/.*)?\.kcm u:object_r:vendor_keychars_file:s0
|
|
|
|
|
/(odm|vendor/odm|vendor|system/vendor)/usr/idc(/.*)?\.idc u:object_r:vendor_idc_file:s0
|
2018-10-08 21:04:15 +02:00
|
|
|
|
2015-05-07 01:33:56 +02:00
|
|
|
/oem(/.*)? u:object_r:oemfs:s0
|
2019-02-25 14:41:13 +01:00
|
|
|
/oem/overlay(/.*)? u:object_r:vendor_overlay_file:s0
|
2015-05-07 01:33:56 +02:00
|
|
|
|
2017-11-27 04:41:33 +01:00
|
|
|
# The precompiled monolithic sepolicy will be under /odm only when
|
|
|
|
|
# BOARD_USES_ODMIMAGE is true: a separate odm.img is built.
|
|
|
|
|
/odm/etc/selinux/precompiled_sepolicy u:object_r:sepolicy_file:s0
|
|
|
|
|
/odm/etc/selinux/precompiled_sepolicy\.plat_and_mapping\.sha256 u:object_r:sepolicy_file:s0
|
|
|
|
|
|
2018-10-24 15:50:22 +02:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_sepolicy\.cil u:object_r:sepolicy_file:s0
|
2017-11-29 09:14:53 +01:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_file_contexts u:object_r:file_contexts_file:s0
|
2017-11-29 09:15:28 +01:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_seapp_contexts u:object_r:seapp_contexts_file:s0
|
2017-11-29 09:15:55 +01:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_property_contexts u:object_r:property_contexts_file:s0
|
2017-11-29 09:16:26 +01:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
2018-10-24 15:50:22 +02:00
|
|
|
/(odm|vendor/odm)/etc/selinux/odm_mac_permissions\.xml u:object_r:mac_perms_file:s0
|
2015-03-18 21:11:11 +01:00
|
|
|
|
2018-01-17 07:27:35 +01:00
|
|
|
#############################
|
|
|
|
|
# Product files
|
|
|
|
|
#
|
2018-05-29 14:17:03 +02:00
|
|
|
/(product|system/product)(/.*)? u:object_r:system_file:s0
|
2019-07-15 22:33:48 +02:00
|
|
|
/(product|system/product)/etc/group u:object_r:system_group_file:s0
|
|
|
|
|
/(product|system/product)/etc/passwd u:object_r:system_passwd_file:s0
|
2018-09-27 09:45:30 +02:00
|
|
|
/(product|system/product)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
|
2018-05-29 14:17:03 +02:00
|
|
|
|
2018-12-21 01:13:10 +01:00
|
|
|
/(product|system/product)/etc/selinux/product_file_contexts u:object_r:file_contexts_file:s0
|
|
|
|
|
/(product|system/product)/etc/selinux/product_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
2018-12-21 04:31:42 +01:00
|
|
|
/(product|system/product)/etc/selinux/product_property_contexts u:object_r:property_contexts_file:s0
|
2018-12-21 19:46:45 +01:00
|
|
|
/(product|system/product)/etc/selinux/product_seapp_contexts u:object_r:seapp_contexts_file:s0
|
2018-12-21 21:28:14 +01:00
|
|
|
/(product|system/product)/etc/selinux/product_service_contexts u:object_r:service_contexts_file:s0
|
2018-12-22 01:07:21 +01:00
|
|
|
/(product|system/product)/etc/selinux/product_mac_permissions\.xml u:object_r:mac_perms_file:s0
|
2018-12-19 04:51:19 +01:00
|
|
|
|
2019-07-29 21:39:08 +02:00
|
|
|
/(product|system/product)/lib(64)?(/.*)? u:object_r:system_lib_file:s0
|
|
|
|
|
|
2018-05-29 14:17:03 +02:00
|
|
|
#############################
|
2019-06-26 02:27:36 +02:00
|
|
|
# SystemExt files
|
2018-05-29 14:17:03 +02:00
|
|
|
#
|
2019-06-26 02:27:36 +02:00
|
|
|
/(system_ext|system/system_ext)(/.*)? u:object_r:system_file:s0
|
2019-07-15 22:33:48 +02:00
|
|
|
/(system_ext|system/system_ext)/etc/group u:object_r:system_group_file:s0
|
|
|
|
|
/(system_ext|system/system_ext)/etc/passwd u:object_r:system_passwd_file:s0
|
2019-06-26 02:27:36 +02:00
|
|
|
/(system_ext|system/system_ext)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
|
2018-11-06 07:00:49 +01:00
|
|
|
|
2019-09-09 16:05:49 +02:00
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_file_contexts u:object_r:file_contexts_file:s0
|
|
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
|
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_property_contexts u:object_r:property_contexts_file:s0
|
|
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_seapp_contexts u:object_r:seapp_contexts_file:s0
|
|
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_service_contexts u:object_r:service_contexts_file:s0
|
|
|
|
|
/(system_ext|system/system_ext)/etc/selinux/system_ext_mac_permissions\.xml u:object_r:mac_perms_file:s0
|
2019-09-09 16:04:06 +02:00
|
|
|
|
2018-11-06 07:00:49 +01:00
|
|
|
#############################
|
|
|
|
|
# Vendor files from /(product|system/product)/vendor_overlay
|
|
|
|
|
#
|
|
|
|
|
# NOTE: For additional vendor file contexts for vendor overlay files,
|
|
|
|
|
# use device specific file_contexts.
|
|
|
|
|
#
|
|
|
|
|
/(product|system/product)/vendor_overlay/[0-9]+/.* u:object_r:vendor_file:s0
|
2018-01-17 07:27:35 +01:00
|
|
|
|
2013-03-20 20:03:04 +01:00
|
|
|
#############################
|
2012-01-04 18:33:27 +01:00
|
|
|
# Data files
|
|
|
|
|
#
|
2015-04-07 01:21:54 +02:00
|
|
|
# NOTE: When modifying existing label rules, changes may also need to
|
|
|
|
|
# propagate to the "Expanded data files" section.
|
|
|
|
|
#
|
2019-08-02 00:57:47 +02:00
|
|
|
/data u:object_r:system_data_root_file:s0
|
|
|
|
|
/data/(.*)? u:object_r:system_data_file:s0
|
Relabel /data/system/packages.list to new type.
Conservatively grant access to packages_list_file to everything that had
access to system_data_file:file even if the comment in the SELinux
policy suggests it was for another use.
Ran a diff on the resulting SEPolicy, the only difference of domains
being granted is those that had system_data_file:dir permissiosn which
is clearly not applicable for packages.list
diff -u0 <(sesearch --allow -t system_data_file ~/sepolicy | sed 's/system_data_file/packages_list_file/') <(sesearch --allow -t packages_list_file ~/sepolicy_new)
--- /proc/self/fd/16 2019-03-19 20:01:44.378409146 +0000
+++ /proc/self/fd/18 2019-03-19 20:01:44.378409146 +0000
@@ -3 +2,0 @@
-allow appdomain packages_list_file:dir getattr;
@@ -6 +4,0 @@
-allow coredomain packages_list_file:dir getattr;
@@ -8 +5,0 @@
-allow domain packages_list_file:dir search;
@@ -35 +31,0 @@
-allow system_server packages_list_file:dir { rename search setattr read lock create reparent getattr write relabelfrom ioctl rmdir remove_name open add_name };
@@ -40 +35,0 @@
-allow tee packages_list_file:dir { search read lock getattr ioctl open };
@@ -43,3 +37,0 @@
-allow traced_probes packages_list_file:dir { read getattr open search };
-allow vendor_init packages_list_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name open add_name };
-allow vold packages_list_file:dir { search setattr read lock create getattr mounton write ioctl rmdir remove_name open add_name };
@@ -48 +39,0 @@
-allow vold_prepare_subdirs packages_list_file:dir { read write relabelfrom rmdir remove_name open add_name };
@@ -50 +40,0 @@
-allow zygote packages_list_file:dir { search read lock getattr ioctl open };
Bug: 123186697
Change-Id: Ieabf313653deb5314872b63cd47dadd535af7b07
2019-03-19 19:14:38 +01:00
|
|
|
/data/system/packages\.list u:object_r:packages_list_file:s0
|
2015-03-11 23:44:14 +01:00
|
|
|
/data/unencrypted(/.*)? u:object_r:unencrypted_data_file:s0
|
2012-12-04 14:13:58 +01:00
|
|
|
/data/backup(/.*)? u:object_r:backup_data_file:s0
|
|
|
|
|
/data/secure/backup(/.*)? u:object_r:backup_data_file:s0
|
2014-02-04 20:29:51 +01:00
|
|
|
/data/system/ndebugsocket u:object_r:system_ndebug_socket:s0
|
2019-12-30 06:38:38 +01:00
|
|
|
/data/system/unsolzygotesocket u:object_r:system_unsolzygote_socket:s0
|
2012-03-07 20:59:01 +01:00
|
|
|
/data/drm(/.*)? u:object_r:drm_data_file:s0
|
2014-06-16 23:19:31 +02:00
|
|
|
/data/resource-cache(/.*)? u:object_r:resourcecache_data_file:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/data/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0
|
2015-12-03 06:23:30 +01:00
|
|
|
/data/ota(/.*)? u:object_r:ota_data_file:s0
|
2016-05-25 06:07:48 +02:00
|
|
|
/data/ota_package(/.*)? u:object_r:ota_package_file:s0
|
2014-10-21 06:56:02 +02:00
|
|
|
/data/adb(/.*)? u:object_r:adb_data_file:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/data/anr(/.*)? u:object_r:anr_data_file:s0
|
2018-08-17 09:35:42 +02:00
|
|
|
/data/apex(/.*)? u:object_r:apex_data_file:s0
|
2019-03-01 12:28:23 +01:00
|
|
|
/data/apex/active/(.*)? u:object_r:staging_data_file:s0
|
|
|
|
|
/data/apex/backup/(.*)? u:object_r:staging_data_file:s0
|
2014-07-07 19:58:53 +02:00
|
|
|
/data/app(/.*)? u:object_r:apk_data_file:s0
|
2015-03-04 03:19:12 +01:00
|
|
|
/data/app/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
|
|
|
|
/data/app/vmdl[^/]+\.tmp(/.*)? u:object_r:apk_tmp_file:s0
|
|
|
|
|
/data/app/vmdl[^/]+\.tmp/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
2014-07-07 19:58:53 +02:00
|
|
|
/data/app-private(/.*)? u:object_r:apk_private_data_file:s0
|
|
|
|
|
/data/app-private/vmdl.*\.tmp(/.*)? u:object_r:apk_private_tmp_file:s0
|
2019-01-23 04:05:29 +01:00
|
|
|
/data/gsi(/.*)? u:object_r:gsi_data_file:s0
|
2019-08-07 22:01:15 +02:00
|
|
|
/data/gsi/ota(/.*)? u:object_r:ota_image_data_file:s0
|
2019-12-18 23:02:38 +01:00
|
|
|
/data/incremental(/.*)? u:object_r:incremental_root_file:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/data/tombstones(/.*)? u:object_r:tombstone_data_file:s0
|
2017-12-15 23:01:44 +01:00
|
|
|
/data/vendor/tombstones/wifi(/.*)? u:object_r:tombstone_wifi_data_file:s0
|
2013-03-26 19:00:13 +01:00
|
|
|
/data/local/tmp(/.*)? u:object_r:shell_data_file:s0
|
2018-02-20 21:41:30 +01:00
|
|
|
/data/local/tmp/ltp(/.*)? u:object_r:nativetest_data_file:s0
|
2018-01-16 01:44:04 +01:00
|
|
|
/data/local/traces(/.*)? u:object_r:trace_data_file:s0
|
2013-12-17 20:39:35 +01:00
|
|
|
/data/media(/.*)? u:object_r:media_rw_data_file:s0
|
2014-01-08 03:53:01 +01:00
|
|
|
/data/mediadrm(/.*)? u:object_r:media_data_file:s0
|
2015-10-29 00:45:58 +01:00
|
|
|
/data/nativetest(/.*)? u:object_r:nativetest_data_file:s0
|
2017-01-12 23:18:50 +01:00
|
|
|
/data/nativetest64(/.*)? u:object_r:nativetest_data_file:s0
|
2019-04-09 18:12:13 +02:00
|
|
|
# This directory was removed after Q Beta 2, but we need to preserve labels for upgrading devices.
|
|
|
|
|
/data/pkg_staging(/.*)? u:object_r:staging_data_file:s0
|
2014-05-29 15:22:16 +02:00
|
|
|
/data/property(/.*)? u:object_r:property_data_file:s0
|
2016-05-20 20:08:45 +02:00
|
|
|
/data/preloads(/.*)? u:object_r:preloads_data_file:s0
|
2017-03-14 19:42:03 +01:00
|
|
|
/data/preloads/media(/.*)? u:object_r:preloads_media_file:s0
|
|
|
|
|
/data/preloads/demo(/.*)? u:object_r:preloads_media_file:s0
|
2018-11-09 01:46:19 +01:00
|
|
|
/data/server_configurable_flags(/.*)? u:object_r:server_configurable_flags_data_file:s0
|
2019-02-27 12:21:20 +01:00
|
|
|
/data/app-staging(/.*)? u:object_r:staging_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
# Misc data
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/adb(/.*)? u:object_r:adb_keys_file:s0
|
2019-11-19 19:10:16 +01:00
|
|
|
/data/misc/apexdata(/.*)? u:object_r:apex_module_data_file:s0
|
2020-01-17 00:47:02 +01:00
|
|
|
/data/misc/apexdata/com.android.permission(/.*)? u:object_r:apex_permission_data_file:s0
|
2019-12-02 19:29:48 +01:00
|
|
|
/data/misc/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
|
2018-05-21 17:01:02 +02:00
|
|
|
/data/misc/apns(/.*)? u:object_r:radio_data_file:s0
|
2013-11-07 19:42:46 +01:00
|
|
|
/data/misc/audio(/.*)? u:object_r:audio_data_file:s0
|
2016-02-24 01:16:16 +01:00
|
|
|
/data/misc/audioserver(/.*)? u:object_r:audioserver_data_file:s0
|
2016-08-04 22:40:23 +02:00
|
|
|
/data/misc/audiohal(/.*)? u:object_r:audiohal_data_file:s0
|
2016-01-19 19:54:20 +01:00
|
|
|
/data/misc/bootstat(/.*)? u:object_r:bootstat_data_file:s0
|
2015-06-24 08:24:17 +02:00
|
|
|
/data/misc/boottrace(/.*)? u:object_r:boottrace_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/bluetooth(/.*)? u:object_r:bluetooth_data_file:s0
|
2016-09-16 21:55:42 +02:00
|
|
|
/data/misc/bluetooth/logs(/.*)? u:object_r:bluetooth_logs_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/bluedroid(/.*)? u:object_r:bluetooth_data_file:s0
|
2014-02-04 20:29:51 +01:00
|
|
|
/data/misc/bluedroid/\.a2dp_ctrl u:object_r:bluetooth_socket:s0
|
|
|
|
|
/data/misc/bluedroid/\.a2dp_data u:object_r:bluetooth_socket:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/camera(/.*)? u:object_r:camera_data_file:s0
|
2018-01-02 19:21:33 +01:00
|
|
|
/data/misc/carrierid(/.*)? u:object_r:radio_data_file:s0
|
2012-08-15 12:25:14 +02:00
|
|
|
/data/misc/dhcp(/.*)? u:object_r:dhcp_data_file:s0
|
2018-10-24 15:50:22 +02:00
|
|
|
/data/misc/dhcp-6\.8\.2(/.*)? u:object_r:dhcp_data_file:s0
|
2019-10-15 22:13:56 +02:00
|
|
|
/data/misc/emergencynumberdb(/.*)? u:object_r:emergency_data_file:s0
|
2015-04-18 02:56:31 +02:00
|
|
|
/data/misc/gatekeeper(/.*)? u:object_r:gatekeeper_data_file:s0
|
2016-11-21 08:23:04 +01:00
|
|
|
/data/misc/incidents(/.*)? u:object_r:incident_data_file:s0
|
2019-08-16 22:41:55 +02:00
|
|
|
/data/misc/installd(/.*)? u:object_r:install_data_file:s0
|
2014-10-13 13:10:08 +02:00
|
|
|
/data/misc/keychain(/.*)? u:object_r:keychain_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0
|
2015-05-27 00:12:45 +02:00
|
|
|
/data/misc/logd(/.*)? u:object_r:misc_logd_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/media(/.*)? u:object_r:media_data_file:s0
|
2014-07-08 07:04:57 +02:00
|
|
|
/data/misc/net(/.*)? u:object_r:net_data_file:s0
|
2017-12-14 10:56:32 +01:00
|
|
|
/data/misc/network_watchlist(/.*)? u:object_r:network_watchlist_data_file:s0
|
2018-01-24 17:07:09 +01:00
|
|
|
/data/misc/perfetto-traces(/.*)? u:object_r:perfetto_traces_data_file:s0
|
2016-03-16 16:11:49 +01:00
|
|
|
/data/misc/recovery(/.*)? u:object_r:recovery_data_file:s0
|
2014-05-23 12:01:58 +02:00
|
|
|
/data/misc/shared_relro(/.*)? u:object_r:shared_relro_file:s0
|
2014-03-18 18:29:51 +01:00
|
|
|
/data/misc/sms(/.*)? u:object_r:radio_data_file:s0
|
2019-02-05 22:30:17 +01:00
|
|
|
/data/misc/stats-active-metric(/.*)? u:object_r:stats_data_file:s0
|
2017-12-19 00:14:33 +01:00
|
|
|
/data/misc/stats-data(/.*)? u:object_r:stats_data_file:s0
|
|
|
|
|
/data/misc/stats-service(/.*)? u:object_r:stats_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/systemkeys(/.*)? u:object_r:systemkeys_data_file:s0
|
2017-04-26 22:20:20 +02:00
|
|
|
/data/misc/textclassifier(/.*)? u:object_r:textclassifier_data_file:s0
|
2019-02-13 00:40:02 +01:00
|
|
|
/data/misc/train-info(/.*)? u:object_r:stats_data_file:s0
|
2014-10-13 13:10:08 +02:00
|
|
|
/data/misc/user(/.*)? u:object_r:misc_user_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/vpn(/.*)? u:object_r:vpn_data_file:s0
|
|
|
|
|
/data/misc/wifi(/.*)? u:object_r:wifi_data_file:s0
|
2019-06-10 21:46:09 +02:00
|
|
|
/data/misc_ce/[0-9]+/wifi(/.*)? u:object_r:wifi_data_file:s0
|
2014-01-29 19:45:51 +01:00
|
|
|
/data/misc/wifi/sockets(/.*)? u:object_r:wpa_socket:s0
|
|
|
|
|
/data/misc/wifi/sockets/wpa_ctrl.* u:object_r:system_wpa_socket:s0
|
2013-12-13 00:32:42 +01:00
|
|
|
/data/misc/zoneinfo(/.*)? u:object_r:zoneinfo_data_file:s0
|
2015-04-01 00:03:13 +02:00
|
|
|
/data/misc/vold(/.*)? u:object_r:vold_data_file:s0
|
2018-10-05 23:48:29 +02:00
|
|
|
/data/misc/iorapd(/.*)? u:object_r:iorapd_data_file:s0
|
2015-10-05 23:04:39 +02:00
|
|
|
/data/misc/update_engine(/.*)? u:object_r:update_engine_data_file:s0
|
2017-11-06 12:56:00 +01:00
|
|
|
/data/misc/update_engine_log(/.*)? u:object_r:update_engine_log_data_file:s0
|
2018-04-16 16:49:49 +02:00
|
|
|
/data/system/dropbox(/.*)? u:object_r:dropbox_data_file:s0
|
2015-04-08 01:40:44 +02:00
|
|
|
/data/system/heapdump(/.*)? u:object_r:heapdump_data_file:s0
|
2015-11-10 19:49:57 +01:00
|
|
|
/data/misc/trace(/.*)? u:object_r:method_trace_data_file:s0
|
2017-11-17 17:23:32 +01:00
|
|
|
/data/misc/wmtrace(/.*)? u:object_r:wm_trace_data_file:s0
|
2016-02-01 20:28:39 +01:00
|
|
|
# TODO(calin) label profile reference differently so that only
|
|
|
|
|
# profman run as a special user can write to them
|
|
|
|
|
/data/misc/profiles/cur(/.*)? u:object_r:user_profile_data_file:s0
|
|
|
|
|
/data/misc/profiles/ref(/.*)? u:object_r:user_profile_data_file:s0
|
2016-05-27 21:41:35 +02:00
|
|
|
/data/misc/profman(/.*)? u:object_r:profman_dump_data_file:s0
|
2018-02-08 01:29:06 +01:00
|
|
|
/data/vendor(/.*)? u:object_r:vendor_data_file:s0
|
|
|
|
|
/data/vendor_ce(/.*)? u:object_r:vendor_data_file:s0
|
|
|
|
|
/data/vendor_de(/.*)? u:object_r:vendor_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
|
2017-10-17 01:39:13 +02:00
|
|
|
# storaged proto files
|
2017-10-19 23:41:37 +02:00
|
|
|
/data/misc_de/[0-9]+/storaged(/.*)? u:object_r:storaged_data_file:s0
|
2017-10-17 01:39:13 +02:00
|
|
|
/data/misc_ce/[0-9]+/storaged(/.*)? u:object_r:storaged_data_file:s0
|
|
|
|
|
|
2015-05-13 00:16:06 +02:00
|
|
|
# Fingerprint data
|
|
|
|
|
/data/system/users/[0-9]+/fpdata(/.*)? u:object_r:fingerprintd_data_file:s0
|
|
|
|
|
|
2018-01-22 22:24:10 +01:00
|
|
|
# Fingerprint vendor data file
|
2018-11-19 19:42:11 +01:00
|
|
|
/data/vendor_de/[0-9]+/fpdata(/.*)? u:object_r:fingerprint_vendor_data_file:s0
|
2018-01-22 22:24:10 +01:00
|
|
|
|
2018-11-16 00:28:07 +01:00
|
|
|
# Face vendor data file
|
|
|
|
|
/data/vendor_de/[0-9]+/facedata(/.*)? u:object_r:face_vendor_data_file:s0
|
2019-04-24 02:26:12 +02:00
|
|
|
/data/vendor_ce/[0-9]+/facedata(/.*)? u:object_r:face_vendor_data_file:s0
|
2018-11-16 00:28:07 +01:00
|
|
|
|
|
|
|
|
# Iris vendor data file
|
|
|
|
|
/data/vendor_de/[0-9]+/irisdata(/.*)? u:object_r:iris_vendor_data_file:s0
|
|
|
|
|
|
2014-12-05 06:40:22 +01:00
|
|
|
# Bootchart data
|
|
|
|
|
/data/bootchart(/.*)? u:object_r:bootchart_data_file:s0
|
|
|
|
|
|
2019-01-14 16:02:12 +01:00
|
|
|
# App data snapshots (managed by installd).
|
|
|
|
|
/data/misc_de/[0-9]+/rollback(/.*)? u:object_r:rollback_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/rollback(/.*)? u:object_r:rollback_data_file:s0
|
|
|
|
|
|
2019-11-19 19:10:16 +01:00
|
|
|
# Apex data directories
|
|
|
|
|
/data/misc_de/[0-9]+/apexdata(/.*)? u:object_r:apex_module_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/apexdata(/.*)? u:object_r:apex_module_data_file:s0
|
2020-01-17 00:47:02 +01:00
|
|
|
/data/misc_de/[0-9]+/apexdata/com.android.permission(/.*)? u:object_r:apex_permission_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/apexdata/com.android.permission(/.*)? u:object_r:apex_permission_data_file:s0
|
2019-11-19 19:10:16 +01:00
|
|
|
|
2019-12-02 19:29:48 +01:00
|
|
|
# Apex rollback directories
|
|
|
|
|
/data/misc_de/[0-9]+/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
|
|
|
|
|
|
2015-04-07 01:21:54 +02:00
|
|
|
#############################
|
|
|
|
|
# Expanded data files
|
|
|
|
|
#
|
|
|
|
|
/mnt/expand(/.*)? u:object_r:mnt_expand_file:s0
|
|
|
|
|
/mnt/expand/[^/]+(/.*)? u:object_r:system_data_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/app(/.*)? u:object_r:apk_data_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/app/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp(/.*)? u:object_r:apk_tmp_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/local/tmp(/.*)? u:object_r:shell_data_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/media(/.*)? u:object_r:media_rw_data_file:s0
|
2015-05-15 05:55:31 +02:00
|
|
|
/mnt/expand/[^/]+/misc/vold(/.*)? u:object_r:vold_data_file:s0
|
2015-04-07 01:21:54 +02:00
|
|
|
|
2014-10-31 20:40:12 +01:00
|
|
|
# coredump directory for userdebug/eng devices
|
|
|
|
|
/cores(/.*)? u:object_r:coredump_file:s0
|
|
|
|
|
|
2016-01-27 01:39:34 +01:00
|
|
|
# Wallpaper files
|
2016-02-11 04:39:12 +01:00
|
|
|
/data/system/users/[0-9]+/wallpaper_lock_orig u:object_r:wallpaper_file:s0
|
|
|
|
|
/data/system/users/[0-9]+/wallpaper_lock u:object_r:wallpaper_file:s0
|
2016-01-27 01:39:34 +01:00
|
|
|
/data/system/users/[0-9]+/wallpaper_orig u:object_r:wallpaper_file:s0
|
2012-11-30 16:41:14 +01:00
|
|
|
/data/system/users/[0-9]+/wallpaper u:object_r:wallpaper_file:s0
|
2016-02-23 01:50:01 +01:00
|
|
|
|
|
|
|
|
# Ringtone files
|
|
|
|
|
/data/system_de/[0-9]+/ringtones(/.*)? u:object_r:ringtone_file:s0
|
|
|
|
|
|
2016-03-09 00:06:44 +01:00
|
|
|
# ShortcutManager icons, e.g.
|
|
|
|
|
# /data/system_ce/0/shortcut_service/bitmaps/com.example.app/1457472879282.png
|
|
|
|
|
/data/system_ce/[0-9]+/shortcut_service/bitmaps(/.*)? u:object_r:shortcut_manager_icons:s0
|
|
|
|
|
|
2016-02-25 16:37:06 +01:00
|
|
|
# User icon files
|
2018-10-24 15:50:22 +02:00
|
|
|
/data/system/users/[0-9]+/photo\.png u:object_r:icon_file:s0
|
2016-02-25 16:37:06 +01:00
|
|
|
|
2017-10-13 23:54:32 +02:00
|
|
|
# vold per-user data
|
|
|
|
|
/data/misc_de/[0-9]+/vold(/.*)? u:object_r:vold_data_file:s0
|
|
|
|
|
/data/misc_ce/[0-9]+/vold(/.*)? u:object_r:vold_data_file:s0
|
|
|
|
|
|
2018-10-05 23:48:29 +02:00
|
|
|
# iorapd per-user data
|
|
|
|
|
/data/misc_ce/[0-9]+/iorapd(/.*)? u:object_r:iorapd_data_file:s0
|
|
|
|
|
|
2019-01-15 22:20:13 +01:00
|
|
|
# Backup service persistent per-user bookkeeping
|
|
|
|
|
/data/system_ce/[0-9]+/backup(/.*)? u:object_r:backup_data_file:s0
|
|
|
|
|
# Backup service temporary per-user data for inter-change with apps
|
|
|
|
|
/data/system_ce/[0-9]+/backup_stage(/.*)? u:object_r:backup_data_file:s0
|
|
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
#############################
|
|
|
|
|
# efs files
|
|
|
|
|
#
|
|
|
|
|
/efs(/.*)? u:object_r:efs_file:s0
|
2016-02-23 01:50:01 +01:00
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
#############################
|
|
|
|
|
# Cache files
|
|
|
|
|
#
|
|
|
|
|
/cache(/.*)? u:object_r:cache_file:s0
|
2015-12-22 21:37:17 +01:00
|
|
|
/cache/recovery(/.*)? u:object_r:cache_recovery_file:s0
|
2016-01-28 20:30:41 +01:00
|
|
|
# General backup/restore interchange with apps
|
|
|
|
|
/cache/backup_stage(/.*)? u:object_r:cache_backup_file:s0
|
|
|
|
|
# LocalTransport (backup) uses this subtree
|
|
|
|
|
/cache/backup(/.*)? u:object_r:cache_private_backup_file:s0
|
|
|
|
|
|
2018-06-13 17:02:29 +02:00
|
|
|
#############################
|
|
|
|
|
# Overlayfs support directories
|
|
|
|
|
#
|
|
|
|
|
/cache/overlay(/.*)? u:object_r:overlayfs_file:s0
|
2018-07-02 17:13:40 +02:00
|
|
|
/mnt/scratch(/.*)? u:object_r:overlayfs_file:s0
|
2018-06-13 17:02:29 +02:00
|
|
|
|
2016-05-14 00:22:44 +02:00
|
|
|
/data/cache(/.*)? u:object_r:cache_file:s0
|
|
|
|
|
/data/cache/recovery(/.*)? u:object_r:cache_recovery_file:s0
|
|
|
|
|
# General backup/restore interchange with apps
|
|
|
|
|
/data/cache/backup_stage(/.*)? u:object_r:cache_backup_file:s0
|
|
|
|
|
# LocalTransport (backup) uses this subtree
|
|
|
|
|
/data/cache/backup(/.*)? u:object_r:cache_private_backup_file:s0
|
|
|
|
|
|
2018-05-17 19:15:53 +02:00
|
|
|
#############################
|
|
|
|
|
# Metadata files
|
|
|
|
|
#
|
|
|
|
|
/metadata(/.*)? u:object_r:metadata_file:s0
|
2019-03-12 16:37:13 +01:00
|
|
|
/metadata/apex(/.*)? u:object_r:apex_metadata_file:s0
|
2018-05-17 19:15:53 +02:00
|
|
|
/metadata/vold(/.*)? u:object_r:vold_metadata_file:s0
|
2019-01-23 04:05:29 +01:00
|
|
|
/metadata/gsi(/.*)? u:object_r:gsi_metadata_file:s0
|
2019-08-07 22:01:15 +02:00
|
|
|
/metadata/gsi/ota(/.*)? u:object_r:ota_metadata_file:s0
|
2019-02-28 23:11:34 +01:00
|
|
|
/metadata/password_slots(/.*)? u:object_r:password_slot_metadata_file:s0
|
2019-07-09 04:03:59 +02:00
|
|
|
/metadata/ota(/.*)? u:object_r:ota_metadata_file:s0
|
2018-05-17 19:15:53 +02:00
|
|
|
|
2017-07-27 21:23:00 +02:00
|
|
|
#############################
|
2012-07-30 20:20:40 +02:00
|
|
|
# asec containers
|
2014-07-07 19:58:53 +02:00
|
|
|
/mnt/asec(/.*)? u:object_r:asec_apk_file:s0
|
|
|
|
|
/mnt/asec/[^/]+/[^/]+\.zip u:object_r:asec_public_file:s0
|
|
|
|
|
/mnt/asec/[^/]+/lib(/.*)? u:object_r:asec_public_file:s0
|
|
|
|
|
/data/app-asec(/.*)? u:object_r:asec_image_file:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
|
|
|
|
|
#############################
|
|
|
|
|
# external storage
|
|
|
|
|
/mnt/media_rw(/.*)? u:object_r:mnt_media_rw_file:s0
|
|
|
|
|
/mnt/user(/.*)? u:object_r:mnt_user_file:s0
|
2019-04-12 00:23:24 +02:00
|
|
|
/mnt/sdcard u:object_r:mnt_sdcard_file:s0
|
2015-08-06 20:52:45 +02:00
|
|
|
/mnt/runtime(/.*)? u:object_r:storage_file:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
/storage(/.*)? u:object_r:storage_file:s0
|
2018-04-11 05:49:45 +02:00
|
|
|
|
|
|
|
|
#############################
|
|
|
|
|
# mount point for read-write vendor partitions
|
2018-06-29 04:10:00 +02:00
|
|
|
/mnt/vendor(/.*)? u:object_r:mnt_vendor_file:s0
|
|
|
|
|
|
|
|
|
|
#############################
|
|
|
|
|
# mount point for read-write product partitions
|
|
|
|
|
/mnt/product(/.*)? u:object_r:mnt_product_file:s0
|
