2012-01-04 18:33:27 +01:00
|
|
|
###########################################
|
|
|
|
|
# Root
|
2015-07-24 06:08:32 +02:00
|
|
|
/ u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
|
|
|
|
# Data files
|
2015-07-24 06:08:32 +02:00
|
|
|
/adb_keys u:object_r:adb_keys_file:s0
|
|
|
|
|
/build\.prop u:object_r:rootfs:s0
|
|
|
|
|
/default\.prop u:object_r:rootfs:s0
|
|
|
|
|
/fstab\..* u:object_r:rootfs:s0
|
|
|
|
|
/init\..* u:object_r:rootfs:s0
|
|
|
|
|
/res(/.*)? u:object_r:rootfs:s0
|
|
|
|
|
/selinux_version u:object_r:rootfs:s0
|
|
|
|
|
/ueventd\..* u:object_r:rootfs:s0
|
|
|
|
|
/verity_key u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
|
|
|
|
# Executables
|
2015-07-24 06:08:32 +02:00
|
|
|
/charger u:object_r:rootfs:s0
|
|
|
|
|
/init u:object_r:init_exec:s0
|
|
|
|
|
/sbin(/.*)? u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
|
|
|
|
# Empty directories
|
2015-07-24 06:08:32 +02:00
|
|
|
/lost\+found u:object_r:rootfs:s0
|
|
|
|
|
/acct u:object_r:cgroup:s0
|
|
|
|
|
/config u:object_r:rootfs:s0
|
|
|
|
|
/mnt u:object_r:tmpfs:s0
|
2016-03-02 01:14:45 +01:00
|
|
|
/postinstall u:object_r:postinstall_mnt_dir:s0
|
2015-07-24 06:08:32 +02:00
|
|
|
/proc u:object_r:rootfs:s0
|
|
|
|
|
/root u:object_r:rootfs:s0
|
|
|
|
|
/sys u:object_r:sysfs:s0
|
|
|
|
|
|
|
|
|
|
# Symlinks
|
|
|
|
|
/d u:object_r:rootfs:s0
|
|
|
|
|
/etc u:object_r:rootfs:s0
|
|
|
|
|
/sdcard u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
|
|
|
|
# SELinux policy files
|
2015-09-15 21:53:29 +02:00
|
|
|
/file_contexts\.bin u:object_r:rootfs:s0
|
2015-12-02 01:58:27 +01:00
|
|
|
/property_contexts u:object_r:property_contexts:s0
|
2015-07-24 06:08:32 +02:00
|
|
|
/seapp_contexts u:object_r:rootfs:s0
|
|
|
|
|
/sepolicy u:object_r:rootfs:s0
|
|
|
|
|
/service_contexts u:object_r:rootfs:s0
|
2012-12-21 00:26:02 +01:00
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
##########################
|
|
|
|
|
# Devices
|
|
|
|
|
#
|
|
|
|
|
/dev(/.*)? u:object_r:device:s0
|
2014-01-16 14:47:34 +01:00
|
|
|
/dev/akm8973.* u:object_r:sensors_device:s0
|
|
|
|
|
/dev/accelerometer u:object_r:sensors_device:s0
|
2014-06-04 02:01:10 +02:00
|
|
|
/dev/adf[0-9]* u:object_r:graphics_device:s0
|
|
|
|
|
/dev/adf-interface[0-9]*\.[0-9]* u:object_r:graphics_device:s0
|
|
|
|
|
/dev/adf-overlay-engine[0-9]*\.[0-9]* u:object_r:graphics_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/alarm u:object_r:alarm_device:s0
|
|
|
|
|
/dev/android_adb.* u:object_r:adb_device:s0
|
|
|
|
|
/dev/ashmem u:object_r:ashmem_device:s0
|
|
|
|
|
/dev/audio.* u:object_r:audio_device:s0
|
|
|
|
|
/dev/binder u:object_r:binder_device:s0
|
|
|
|
|
/dev/block(/.*)? u:object_r:block_device:s0
|
2014-09-30 17:37:51 +02:00
|
|
|
/dev/block/dm-[0-9]+ u:object_r:dm_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/block/loop[0-9]* u:object_r:loop_device:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
/dev/block/vold/.+ u:object_r:vold_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/block/ram[0-9]* u:object_r:ram_device:s0
|
2015-08-25 21:06:39 +02:00
|
|
|
/dev/block/zram[0-9]* u:object_r:ram_device:s0
|
2013-03-27 11:30:25 +01:00
|
|
|
/dev/bus/usb(.*)? u:object_r:usb_device:s0
|
2016-01-08 22:29:22 +01:00
|
|
|
/dev/cam u:object_r:video_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/console u:object_r:console_device:s0
|
|
|
|
|
/dev/cpuctl(/.*)? u:object_r:cpuctl_device:s0
|
|
|
|
|
/dev/device-mapper u:object_r:dm_device:s0
|
2012-04-03 21:30:28 +02:00
|
|
|
/dev/eac u:object_r:audio_device:s0
|
2013-11-04 15:47:29 +01:00
|
|
|
/dev/fscklogs(/.*)? u:object_r:fscklogs:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/full u:object_r:full_device:s0
|
2012-05-31 15:44:51 +02:00
|
|
|
/dev/fuse u:object_r:fuse_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/graphics(/.*)? u:object_r:graphics_device:s0
|
2013-10-03 22:35:56 +02:00
|
|
|
/dev/hw_random u:object_r:hw_random_device:s0
|
2015-10-22 20:51:09 +02:00
|
|
|
/dev/i2c-[0-9]+ u:object_r:i2c_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/input(/.*) u:object_r:input_device:s0
|
2013-01-30 19:17:14 +01:00
|
|
|
/dev/iio:device[0-9]+ u:object_r:iio_device:s0
|
2012-06-20 03:46:16 +02:00
|
|
|
/dev/ion u:object_r:ion_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/kmem u:object_r:kmem_device:s0
|
|
|
|
|
/dev/log(/.*)? u:object_r:log_device:s0
|
|
|
|
|
/dev/mem u:object_r:kmem_device:s0
|
|
|
|
|
/dev/modem.* u:object_r:radio_device:s0
|
2013-01-18 21:18:09 +01:00
|
|
|
/dev/mpu u:object_r:gps_device:s0
|
|
|
|
|
/dev/mpuirq u:object_r:gps_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/mtd(/.*)? u:object_r:mtd_device:s0
|
2012-01-06 16:25:53 +01:00
|
|
|
/dev/mtp_usb u:object_r:mtp_device:s0
|
2014-12-15 21:01:35 +01:00
|
|
|
/dev/pmsg0 u:object_r:pmsg_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/pn544 u:object_r:nfc_device:s0
|
2012-08-20 12:13:28 +02:00
|
|
|
/dev/ppp u:object_r:ppp_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/ptmx u:object_r:ptmx_device:s0
|
2014-01-16 14:47:34 +01:00
|
|
|
/dev/pvrsrvkm u:object_r:gpu_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/kmsg u:object_r:kmsg_device:s0
|
|
|
|
|
/dev/null u:object_r:null_device:s0
|
|
|
|
|
/dev/nvhdcp1 u:object_r:video_device:s0
|
|
|
|
|
/dev/random u:object_r:random_device:s0
|
2012-07-11 20:21:05 +02:00
|
|
|
/dev/rpmsg-omx[0-9] u:object_r:rpmsg_device:s0
|
|
|
|
|
/dev/rproc_user u:object_r:rpmsg_device:s0
|
2015-05-21 19:03:16 +02:00
|
|
|
/dev/rtc[0-9] u:object_r:rtc_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/snd(/.*)? u:object_r:audio_device:s0
|
2013-12-02 15:02:22 +01:00
|
|
|
/dev/socket(/.*)? u:object_r:socket_device:s0
|
2012-11-16 15:06:47 +01:00
|
|
|
/dev/socket/adbd u:object_r:adbd_socket:s0
|
2015-03-19 10:56:26 +01:00
|
|
|
/dev/socket/sap_uim_socket[0-9] u:object_r:sap_uim_socket:s0
|
2015-06-03 23:09:21 +02:00
|
|
|
/dev/socket/cryptd u:object_r:vold_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/socket/dnsproxyd u:object_r:dnsproxyd_socket:s0
|
2013-12-14 07:19:45 +01:00
|
|
|
/dev/socket/dumpstate u:object_r:dumpstate_socket:s0
|
2014-05-01 20:12:10 +02:00
|
|
|
/dev/socket/fwmarkd u:object_r:fwmarkd_socket:s0
|
2013-09-20 18:32:45 +02:00
|
|
|
/dev/socket/gps u:object_r:gps_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/socket/installd u:object_r:installd_socket:s0
|
2013-12-06 01:55:34 +01:00
|
|
|
/dev/socket/lmkd u:object_r:lmkd_socket:s0
|
2013-11-13 00:34:52 +01:00
|
|
|
/dev/socket/logd u:object_r:logd_socket:s0
|
|
|
|
|
/dev/socket/logdr u:object_r:logdr_socket:s0
|
|
|
|
|
/dev/socket/logdw u:object_r:logdw_socket:s0
|
2013-09-19 21:09:38 +02:00
|
|
|
/dev/socket/mdns u:object_r:mdns_socket:s0
|
2014-02-24 19:04:49 +01:00
|
|
|
/dev/socket/mdnsd u:object_r:mdnsd_socket:s0
|
2014-03-05 15:50:08 +01:00
|
|
|
/dev/socket/mtpd u:object_r:mtpd_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/socket/netd u:object_r:netd_socket:s0
|
|
|
|
|
/dev/socket/property_service u:object_r:property_socket:s0
|
2013-01-07 15:21:18 +01:00
|
|
|
/dev/socket/racoon u:object_r:racoon_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/socket/rild u:object_r:rild_socket:s0
|
|
|
|
|
/dev/socket/rild-debug u:object_r:rild_debug_socket:s0
|
|
|
|
|
/dev/socket/vold u:object_r:vold_socket:s0
|
|
|
|
|
/dev/socket/wpa_eth[0-9] u:object_r:wpa_socket:s0
|
|
|
|
|
/dev/socket/wpa_wlan[0-9] u:object_r:wpa_socket:s0
|
|
|
|
|
/dev/socket/zygote u:object_r:zygote_socket:s0
|
2014-05-23 01:48:20 +02:00
|
|
|
/dev/socket/zygote_secondary u:object_r:zygote_socket:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/spdif_out.* u:object_r:audio_device:s0
|
|
|
|
|
/dev/tegra.* u:object_r:video_device:s0
|
2012-08-24 14:11:09 +02:00
|
|
|
/dev/tf_driver u:object_r:tee_device:s0
|
2013-04-05 20:22:27 +02:00
|
|
|
/dev/tty u:object_r:owntty_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/tty[0-9]* u:object_r:tty_device:s0
|
|
|
|
|
/dev/ttyS[0-9]* u:object_r:serial_device:s0
|
2013-01-07 15:21:18 +01:00
|
|
|
/dev/tun u:object_r:tun_device:s0
|
|
|
|
|
/dev/uhid u:object_r:uhid_device:s0
|
2013-10-23 19:50:19 +02:00
|
|
|
/dev/uinput u:object_r:uhid_device:s0
|
2014-03-26 20:37:54 +01:00
|
|
|
/dev/uio[0-9]* u:object_r:uio_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/urandom u:object_r:urandom_device:s0
|
2013-01-30 19:17:14 +01:00
|
|
|
/dev/usb_accessory u:object_r:usbaccessory_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/vcs[0-9a-z]* u:object_r:vcs_device:s0
|
|
|
|
|
/dev/video[0-9]* u:object_r:video_device:s0
|
2012-12-03 12:07:45 +01:00
|
|
|
/dev/watchdog u:object_r:watchdog_device:s0
|
2012-07-19 20:07:04 +02:00
|
|
|
/dev/xt_qtaguid u:object_r:qtaguid_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/dev/zero u:object_r:zero_device:s0
|
2013-05-09 21:39:32 +02:00
|
|
|
/dev/__kmsg__ u:object_r:klog_device:s0
|
2013-03-01 02:33:16 +01:00
|
|
|
/dev/__properties__ u:object_r:properties_device:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
#############################
|
|
|
|
|
# System files
|
|
|
|
|
#
|
|
|
|
|
/system(/.*)? u:object_r:system_file:s0
|
2015-06-24 08:24:17 +02:00
|
|
|
/system/bin/atrace u:object_r:atrace_exec:s0
|
2014-09-23 15:11:30 +02:00
|
|
|
/system/bin/e2fsck -- u:object_r:fsck_exec:s0
|
2014-10-20 19:36:49 +02:00
|
|
|
/system/bin/fsck\.f2fs -- u:object_r:fsck_exec:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
/system/bin/fsck_msdos -- u:object_r:fsck_exec:s0
|
2014-09-23 15:11:30 +02:00
|
|
|
/system/bin/toolbox -- u:object_r:toolbox_exec:s0
|
2014-12-18 01:03:01 +01:00
|
|
|
/system/bin/toybox -- u:object_r:toolbox_exec:s0
|
2014-09-04 14:44:49 +02:00
|
|
|
/system/bin/logcat -- u:object_r:logcat_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/sh -- u:object_r:shell_exec:s0
|
2012-11-13 19:00:05 +01:00
|
|
|
/system/bin/run-as -- u:object_r:runas_exec:s0
|
2013-12-11 21:17:53 +01:00
|
|
|
/system/bin/bootanimation u:object_r:bootanim_exec:s0
|
2016-01-26 01:23:10 +01:00
|
|
|
/system/bin/bootstat u:object_r:bootstat_exec:s0
|
2014-05-14 18:13:24 +02:00
|
|
|
/system/bin/app_process32 u:object_r:zygote_exec:s0
|
2014-04-04 18:45:57 +02:00
|
|
|
/system/bin/app_process64 u:object_r:zygote_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/servicemanager u:object_r:servicemanager_exec:s0
|
|
|
|
|
/system/bin/surfaceflinger u:object_r:surfaceflinger_exec:s0
|
|
|
|
|
/system/bin/drmserver u:object_r:drmserver_exec:s0
|
2013-12-14 07:19:45 +01:00
|
|
|
/system/bin/dumpstate u:object_r:dumpstate_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/vold u:object_r:vold_exec:s0
|
|
|
|
|
/system/bin/netd u:object_r:netd_exec:s0
|
|
|
|
|
/system/bin/rild u:object_r:rild_exec:s0
|
|
|
|
|
/system/bin/mediaserver u:object_r:mediaserver_exec:s0
|
2014-02-24 19:04:49 +01:00
|
|
|
/system/bin/mdnsd u:object_r:mdnsd_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/installd u:object_r:installd_exec:s0
|
|
|
|
|
/system/bin/keystore u:object_r:keystore_exec:s0
|
2015-05-13 00:16:06 +02:00
|
|
|
/system/bin/fingerprintd u:object_r:fingerprintd_exec:s0
|
2015-04-04 01:46:33 +02:00
|
|
|
/system/bin/gatekeeperd u:object_r:gatekeeperd_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/debuggerd u:object_r:debuggerd_exec:s0
|
2014-02-16 20:34:25 +01:00
|
|
|
/system/bin/debuggerd64 u:object_r:debuggerd_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/bin/wpa_supplicant u:object_r:wpa_exec:s0
|
2012-05-31 15:44:51 +02:00
|
|
|
/system/bin/sdcard u:object_r:sdcardd_exec:s0
|
2012-08-15 12:25:14 +02:00
|
|
|
/system/bin/dhcpcd u:object_r:dhcp_exec:s0
|
2015-08-27 03:18:21 +02:00
|
|
|
/system/bin/dhcpcd-6.8.2 u:object_r:dhcp_exec:s0
|
2012-08-20 12:13:28 +02:00
|
|
|
/system/bin/mtpd u:object_r:mtp_exec:s0
|
|
|
|
|
/system/bin/pppd u:object_r:ppp_exec:s0
|
2012-08-24 14:11:09 +02:00
|
|
|
/system/bin/tf_daemon u:object_r:tee_exec:s0
|
2013-01-07 15:21:18 +01:00
|
|
|
/system/bin/racoon u:object_r:racoon_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/xbin/su u:object_r:su_exec:s0
|
2015-04-30 21:27:36 +02:00
|
|
|
/system/xbin/perfprofd u:object_r:perfprofd_exec:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/system/vendor/bin/gpsd u:object_r:gpsd_exec:s0
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
/system/bin/dnsmasq u:object_r:dnsmasq_exec:s0
|
|
|
|
|
/system/bin/hostapd u:object_r:hostapd_exec:s0
|
2013-08-05 08:32:56 +02:00
|
|
|
/system/bin/clatd u:object_r:clatd_exec:s0
|
2013-12-06 01:55:34 +01:00
|
|
|
/system/bin/lmkd u:object_r:lmkd_exec:s0
|
2013-12-15 21:50:00 +01:00
|
|
|
/system/bin/inputflinger u:object_r:inputflinger_exec:s0
|
2013-11-13 00:34:52 +01:00
|
|
|
/system/bin/logd u:object_r:logd_exec:s0
|
2014-02-19 22:33:32 +01:00
|
|
|
/system/bin/uncrypt u:object_r:uncrypt_exec:s0
|
2015-12-05 02:48:50 +01:00
|
|
|
/system/bin/update_verifier u:object_r:update_verifier_exec:s0
|
2014-06-17 17:49:17 +02:00
|
|
|
/system/bin/logwrapper u:object_r:system_file:s0
|
2014-06-21 03:11:11 +02:00
|
|
|
/system/bin/vdc u:object_r:vdc_exec:s0
|
2014-07-03 01:18:16 +02:00
|
|
|
/system/bin/install-recovery.sh u:object_r:install_recovery_exec:s0
|
2014-07-03 07:59:19 +02:00
|
|
|
/system/bin/dex2oat u:object_r:dex2oat_exec:s0
|
2014-08-05 18:15:01 +02:00
|
|
|
# patchoat executable has (essentially) the same requirements as dex2oat.
|
|
|
|
|
/system/bin/patchoat u:object_r:dex2oat_exec:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
/system/bin/sgdisk u:object_r:sgdisk_exec:s0
|
|
|
|
|
/system/bin/blkid u:object_r:blkid_exec:s0
|
2015-04-07 14:35:21 +02:00
|
|
|
/system/bin/tzdatacheck u:object_r:tzdatacheck_exec:s0
|
2015-06-19 19:47:26 +02:00
|
|
|
/system/bin/idmap u:object_r:idmap_exec:s0
|
2015-10-05 23:04:39 +02:00
|
|
|
/system/bin/update_engine u:object_r:update_engine_exec:s0
|
2015-11-21 01:09:14 +01:00
|
|
|
/system/bin/bspatch u:object_r:update_engine_exec:s0
|
2014-07-03 01:18:16 +02:00
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
#############################
|
2013-03-20 20:03:04 +01:00
|
|
|
# Vendor files
|
|
|
|
|
#
|
|
|
|
|
/vendor(/.*)? u:object_r:system_file:s0
|
|
|
|
|
/vendor/bin/gpsd u:object_r:gpsd_exec:s0
|
2015-03-18 21:11:11 +01:00
|
|
|
|
|
|
|
|
#############################
|
2015-05-07 01:33:56 +02:00
|
|
|
# OEM and ODM files
|
2015-03-18 21:11:11 +01:00
|
|
|
#
|
2015-05-07 01:33:56 +02:00
|
|
|
/odm(/.*)? u:object_r:system_file:s0
|
|
|
|
|
/oem(/.*)? u:object_r:oemfs:s0
|
|
|
|
|
|
2015-03-18 21:11:11 +01:00
|
|
|
|
2013-03-20 20:03:04 +01:00
|
|
|
#############################
|
2012-01-04 18:33:27 +01:00
|
|
|
# Data files
|
|
|
|
|
#
|
2015-04-07 01:21:54 +02:00
|
|
|
# NOTE: When modifying existing label rules, changes may also need to
|
|
|
|
|
# propagate to the "Expanded data files" section.
|
|
|
|
|
#
|
2012-01-04 18:33:27 +01:00
|
|
|
/data(/.*)? u:object_r:system_data_file:s0
|
2014-05-12 17:18:21 +02:00
|
|
|
/data/.layout_version u:object_r:install_data_file:s0
|
2015-03-11 23:44:14 +01:00
|
|
|
/data/unencrypted(/.*)? u:object_r:unencrypted_data_file:s0
|
2012-12-04 14:13:58 +01:00
|
|
|
/data/backup(/.*)? u:object_r:backup_data_file:s0
|
|
|
|
|
/data/secure/backup(/.*)? u:object_r:backup_data_file:s0
|
2014-02-04 20:29:51 +01:00
|
|
|
/data/system/ndebugsocket u:object_r:system_ndebug_socket:s0
|
2012-03-07 20:59:01 +01:00
|
|
|
/data/drm(/.*)? u:object_r:drm_data_file:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/data/gps(/.*)? u:object_r:gps_data_file:s0
|
2014-06-16 23:19:31 +02:00
|
|
|
/data/resource-cache(/.*)? u:object_r:resourcecache_data_file:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/data/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0
|
2014-10-21 06:56:02 +02:00
|
|
|
/data/adb(/.*)? u:object_r:adb_data_file:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/data/anr(/.*)? u:object_r:anr_data_file:s0
|
2014-07-07 19:58:53 +02:00
|
|
|
/data/app(/.*)? u:object_r:apk_data_file:s0
|
2015-03-04 03:19:12 +01:00
|
|
|
/data/app/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
|
|
|
|
/data/app/vmdl[^/]+\.tmp(/.*)? u:object_r:apk_tmp_file:s0
|
|
|
|
|
/data/app/vmdl[^/]+\.tmp/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
2014-07-07 19:58:53 +02:00
|
|
|
/data/app-private(/.*)? u:object_r:apk_private_data_file:s0
|
|
|
|
|
/data/app-private/vmdl.*\.tmp(/.*)? u:object_r:apk_private_tmp_file:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
/data/tombstones(/.*)? u:object_r:tombstone_data_file:s0
|
2013-03-26 19:00:13 +01:00
|
|
|
/data/local/tmp(/.*)? u:object_r:shell_data_file:s0
|
2013-12-17 20:39:35 +01:00
|
|
|
/data/media(/.*)? u:object_r:media_rw_data_file:s0
|
2014-01-08 03:53:01 +01:00
|
|
|
/data/mediadrm(/.*)? u:object_r:media_data_file:s0
|
2015-10-29 00:45:58 +01:00
|
|
|
/data/nativetest(/.*)? u:object_r:nativetest_data_file:s0
|
2014-05-29 15:22:16 +02:00
|
|
|
/data/property(/.*)? u:object_r:property_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
|
2012-01-04 18:33:27 +01:00
|
|
|
# Misc data
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/adb(/.*)? u:object_r:adb_keys_file:s0
|
2013-11-07 19:42:46 +01:00
|
|
|
/data/misc/audio(/.*)? u:object_r:audio_data_file:s0
|
2016-01-19 19:54:20 +01:00
|
|
|
/data/misc/bootstat(/.*)? u:object_r:bootstat_data_file:s0
|
2015-06-24 08:24:17 +02:00
|
|
|
/data/misc/boottrace(/.*)? u:object_r:boottrace_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/bluetooth(/.*)? u:object_r:bluetooth_data_file:s0
|
|
|
|
|
/data/misc/bluedroid(/.*)? u:object_r:bluetooth_data_file:s0
|
2014-02-04 20:29:51 +01:00
|
|
|
/data/misc/bluedroid/\.a2dp_ctrl u:object_r:bluetooth_socket:s0
|
|
|
|
|
/data/misc/bluedroid/\.a2dp_data u:object_r:bluetooth_socket:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/camera(/.*)? u:object_r:camera_data_file:s0
|
2012-08-15 12:25:14 +02:00
|
|
|
/data/misc/dhcp(/.*)? u:object_r:dhcp_data_file:s0
|
2015-08-27 03:18:21 +02:00
|
|
|
/data/misc/dhcp-6.8.2(/.*)? u:object_r:dhcp_data_file:s0
|
2015-04-18 02:56:31 +02:00
|
|
|
/data/misc/gatekeeper(/.*)? u:object_r:gatekeeper_data_file:s0
|
2014-10-13 13:10:08 +02:00
|
|
|
/data/misc/keychain(/.*)? u:object_r:keychain_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0
|
2015-05-27 00:12:45 +02:00
|
|
|
/data/misc/logd(/.*)? u:object_r:misc_logd_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/media(/.*)? u:object_r:media_data_file:s0
|
2014-07-08 07:04:57 +02:00
|
|
|
/data/misc/net(/.*)? u:object_r:net_data_file:s0
|
2014-05-23 12:01:58 +02:00
|
|
|
/data/misc/shared_relro(/.*)? u:object_r:shared_relro_file:s0
|
2014-03-18 18:29:51 +01:00
|
|
|
/data/misc/sms(/.*)? u:object_r:radio_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/systemkeys(/.*)? u:object_r:systemkeys_data_file:s0
|
2014-10-13 13:10:08 +02:00
|
|
|
/data/misc/user(/.*)? u:object_r:misc_user_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
/data/misc/vpn(/.*)? u:object_r:vpn_data_file:s0
|
|
|
|
|
/data/misc/wifi(/.*)? u:object_r:wifi_data_file:s0
|
2014-01-29 19:45:51 +01:00
|
|
|
/data/misc/wifi/sockets(/.*)? u:object_r:wpa_socket:s0
|
|
|
|
|
/data/misc/wifi/sockets/wpa_ctrl.* u:object_r:system_wpa_socket:s0
|
2014-03-12 20:09:17 +01:00
|
|
|
/data/misc/wifi/hostapd(/.*)? u:object_r:wpa_socket:s0
|
2013-12-13 00:32:42 +01:00
|
|
|
/data/misc/zoneinfo(/.*)? u:object_r:zoneinfo_data_file:s0
|
2015-04-01 00:03:13 +02:00
|
|
|
/data/misc/vold(/.*)? u:object_r:vold_data_file:s0
|
2015-05-06 00:11:44 +02:00
|
|
|
/data/misc/perfprofd(/.*)? u:object_r:perfprofd_data_file:s0
|
2015-10-05 23:04:39 +02:00
|
|
|
/data/misc/update_engine(/.*)? u:object_r:update_engine_data_file:s0
|
2015-04-08 01:40:44 +02:00
|
|
|
/data/system/heapdump(/.*)? u:object_r:heapdump_data_file:s0
|
2015-11-10 19:49:57 +01:00
|
|
|
/data/misc/trace(/.*)? u:object_r:method_trace_data_file:s0
|
2013-12-13 00:23:10 +01:00
|
|
|
|
2015-05-13 00:16:06 +02:00
|
|
|
# Fingerprint data
|
|
|
|
|
/data/system/users/[0-9]+/fpdata(/.*)? u:object_r:fingerprintd_data_file:s0
|
|
|
|
|
|
2014-12-05 06:40:22 +01:00
|
|
|
# Bootchart data
|
|
|
|
|
/data/bootchart(/.*)? u:object_r:bootchart_data_file:s0
|
|
|
|
|
|
2015-04-07 01:21:54 +02:00
|
|
|
#############################
|
|
|
|
|
# Expanded data files
|
|
|
|
|
#
|
|
|
|
|
/mnt/expand(/.*)? u:object_r:mnt_expand_file:s0
|
|
|
|
|
/mnt/expand/[^/]+(/.*)? u:object_r:system_data_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/app(/.*)? u:object_r:apk_data_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/app/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp(/.*)? u:object_r:apk_tmp_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/local/tmp(/.*)? u:object_r:shell_data_file:s0
|
|
|
|
|
/mnt/expand/[^/]+/media(/.*)? u:object_r:media_rw_data_file:s0
|
2015-05-15 05:55:31 +02:00
|
|
|
/mnt/expand/[^/]+/misc/vold(/.*)? u:object_r:vold_data_file:s0
|
2015-04-07 01:21:54 +02:00
|
|
|
|
2014-10-31 20:40:12 +01:00
|
|
|
# coredump directory for userdebug/eng devices
|
|
|
|
|
/cores(/.*)? u:object_r:coredump_file:s0
|
|
|
|
|
|
2012-11-30 16:41:14 +01:00
|
|
|
# Wallpaper file for other users
|
|
|
|
|
/data/system/users/[0-9]+/wallpaper u:object_r:wallpaper_file:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
#############################
|
|
|
|
|
# efs files
|
|
|
|
|
#
|
|
|
|
|
/efs(/.*)? u:object_r:efs_file:s0
|
|
|
|
|
#############################
|
|
|
|
|
# Cache files
|
|
|
|
|
#
|
|
|
|
|
/cache(/.*)? u:object_r:cache_file:s0
|
2012-12-04 14:13:58 +01:00
|
|
|
/cache/.*\.data u:object_r:cache_backup_file:s0
|
|
|
|
|
/cache/.*\.restore u:object_r:cache_backup_file:s0
|
|
|
|
|
# LocalTransport (backup) uses this directory
|
|
|
|
|
/cache/backup(/.*)? u:object_r:cache_backup_file:s0
|
2015-12-22 21:37:17 +01:00
|
|
|
/cache/recovery(/.*)? u:object_r:cache_recovery_file:s0
|
2012-01-04 18:33:27 +01:00
|
|
|
#############################
|
|
|
|
|
# sysfs files
|
|
|
|
|
#
|
2012-03-19 20:56:01 +01:00
|
|
|
/sys/devices/platform/nfc-power/nfc_power -- u:object_r:sysfs_nfc_power_writable:s0
|
2013-10-30 22:12:21 +01:00
|
|
|
/sys/devices/system/cpu(/.*)? u:object_r:sysfs_devices_system_cpu:s0
|
2016-01-04 23:23:23 +01:00
|
|
|
/sys/devices/virtual/block/zram\d+(/.*)? u:object_r:sysfs_zram:s0
|
|
|
|
|
/sys/devices/virtual/block/zram\d+/uevent u:object_r:sysfs_zram_uevent:s0
|
2016-03-12 00:23:49 +01:00
|
|
|
/sys/devices/virtual/misc/hw_random(/.*)? u:object_r:sysfs_hwrandom:s0
|
2013-09-29 00:46:21 +02:00
|
|
|
/sys/power/wake_lock -- u:object_r:sysfs_wake_lock:s0
|
|
|
|
|
/sys/power/wake_unlock -- u:object_r:sysfs_wake_lock:s0
|
2013-12-06 15:31:40 +01:00
|
|
|
/sys/kernel/uevent_helper -- u:object_r:usermodehelper:s0
|
2014-02-13 21:19:50 +01:00
|
|
|
/sys/module/lowmemorykiller(/.*)? -- u:object_r:sysfs_lowmemorykiller:s0
|
|
|
|
|
|
2015-12-08 02:02:31 +01:00
|
|
|
#############################
|
|
|
|
|
# debugfs files
|
|
|
|
|
#
|
2015-12-14 22:57:26 +01:00
|
|
|
/sys/kernel/debug/tracing(/.*)? u:object_r:debugfs_tracing:s0
|
2015-12-08 02:02:31 +01:00
|
|
|
/sys/kernel/debug/tracing/trace_marker u:object_r:debugfs_trace_marker:s0
|
|
|
|
|
|
2012-07-30 20:20:40 +02:00
|
|
|
#############################
|
|
|
|
|
# asec containers
|
2014-07-07 19:58:53 +02:00
|
|
|
/mnt/asec(/.*)? u:object_r:asec_apk_file:s0
|
|
|
|
|
/mnt/asec/[^/]+/[^/]+\.zip u:object_r:asec_public_file:s0
|
|
|
|
|
/mnt/asec/[^/]+/lib(/.*)? u:object_r:asec_public_file:s0
|
|
|
|
|
/data/app-asec(/.*)? u:object_r:asec_image_file:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
|
|
|
|
|
#############################
|
|
|
|
|
# external storage
|
|
|
|
|
/mnt/media_rw(/.*)? u:object_r:mnt_media_rw_file:s0
|
|
|
|
|
/mnt/user(/.*)? u:object_r:mnt_user_file:s0
|
2015-08-06 20:52:45 +02:00
|
|
|
/mnt/runtime(/.*)? u:object_r:storage_file:s0
|
Updated policy for external storage.
An upcoming platform release is redesigning how external storage
works. At a high level, vold is taking on a more active role in
managing devices that dynamically appear.
This change also creates further restricted domains for tools doing
low-level access of external storage devices, including sgdisk
and blkid. It also extends sdcardd to be launchable by vold, since
launching by init will eventually go away.
For compatibility, rules required to keep AOSP builds working are
marked with "TODO" to eventually remove.
Slightly relax system_server external storage rules to allow calls
like statfs(). Still neverallow open file descriptors, since they
can cause kernel to kill us.
Here are the relevant violations that this CL is designed to allow:
avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket
avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file
avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir
avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir
avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir
avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd
Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
|
|
|
/storage(/.*)? u:object_r:storage_file:s0
|
