tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Grant platform apps access to /mnt/media_rw.

Browse source 
Raw physical storage devices are mounted by vold under /mnt/media_rw
and then wrapped in a FUSE daemon that presents them under /storage.

Normal apps only have access through /storage, but platform apps
(such as ExternalStorageProvider) often bypass the FUSE daemon for
performance reasons.

avc: denied { search } for pid=6411 comm="Binder_1" name="media_rw" dev="tmpfs" ino=6666 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir
avc: denied { write } for pid=3701 comm="Binder_2" name="PANO_20131016_162457.jpg" dev="sda1" ino=127 scontext=u:r:platform_app:s0:c522,c768 tcontext=u:object_r:vfat:s0 tclass=file

Bug: 19993667
Change-Id: I66df236eade3ca25a10749dd43d173ff4628cfad
This commit is contained in:
Jeff Sharkey 2015-04-18 13:34:30 -07:00
parent 6db824a7d9
commit c9036fb1c1
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
platform_app.te
View file

@ -28,6 +28,12 @@ allow platform_app media_rw_data_file:file create_file_perms;
allow platform_app cache_file:dir create_dir_perms; allow platform_app cache_file:dir create_dir_perms;
allow platform_app cache_file:file create_file_perms; allow platform_app cache_file:file create_file_perms;
# Direct access to vold-mounted storage under /mnt/media_rw
# This is a performance optimization that allows platform apps to bypass the FUSE layer
allow platform_app mnt_media_rw_file:dir r_dir_perms;
allow platform_app vfat:dir create_dir_perms;
allow platform_app vfat:file create_file_perms;
allow platform_app drmserver_service:service_manager find; allow platform_app drmserver_service:service_manager find;
allow platform_app mediaserver_service:service_manager find; allow platform_app mediaserver_service:service_manager find;
allow platform_app persistent_data_block_service:service_manager find; allow platform_app persistent_data_block_service:service_manager find;