From c9036fb1c1d6a16c6686ada777e01cc1bf63d6fe Mon Sep 17 00:00:00 2001 From: Jeff Sharkey Date: Sat, 18 Apr 2015 13:34:30 -0700 Subject: [PATCH] Grant platform apps access to /mnt/media_rw. Raw physical storage devices are mounted by vold under /mnt/media_rw and then wrapped in a FUSE daemon that presents them under /storage. Normal apps only have access through /storage, but platform apps (such as ExternalStorageProvider) often bypass the FUSE daemon for performance reasons. avc: denied { search } for pid=6411 comm="Binder_1" name="media_rw" dev="tmpfs" ino=6666 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { write } for pid=3701 comm="Binder_2" name="PANO_20131016_162457.jpg" dev="sda1" ino=127 scontext=u:r:platform_app:s0:c522,c768 tcontext=u:object_r:vfat:s0 tclass=file Bug: 19993667 Change-Id: I66df236eade3ca25a10749dd43d173ff4628cfad --- platform_app.te | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/platform_app.te b/platform_app.te index c152f47a6..2afe4d8ac 100644 --- a/platform_app.te +++ b/platform_app.te @@ -28,6 +28,12 @@ allow platform_app media_rw_data_file:file create_file_perms; allow platform_app cache_file:dir create_dir_perms; allow platform_app cache_file:file create_file_perms; +# Direct access to vold-mounted storage under /mnt/media_rw +# This is a performance optimization that allows platform apps to bypass the FUSE layer +allow platform_app mnt_media_rw_file:dir r_dir_perms; +allow platform_app vfat:dir create_dir_perms; +allow platform_app vfat:file create_file_perms; + allow platform_app drmserver_service:service_manager find; allow platform_app mediaserver_service:service_manager find; allow platform_app persistent_data_block_service:service_manager find;