diff --git a/prebuilts/api/202404/public/domain.te b/prebuilts/api/202404/public/domain.te index 0a2a5e52f..a99984eac 100644 --- a/prebuilts/api/202404/public/domain.te +++ b/prebuilts/api/202404/public/domain.te @@ -509,7 +509,7 @@ neverallow * rootfs:file { create write setattr relabelto append unlink link ren # Restrict context mounts to specific types marked with # the contextmount_type attribute. -neverallow * {fs_type -contextmount_type}:filesystem relabelto; +neverallow * {fs_type -contextmount_type -sdcard_posix_contextmount_type}:filesystem relabelto; # Ensure that context mount types are not writable, to ensure that # the write to /system restriction above is not bypassed via context= diff --git a/prebuilts/api/34.0/public/attributes b/prebuilts/api/34.0/public/attributes index 16a8e66af..83e04c1d7 100644 --- a/prebuilts/api/34.0/public/attributes +++ b/prebuilts/api/34.0/public/attributes @@ -27,6 +27,9 @@ attribute contextmount_type; # example. attribute fusefs_type; +# All types used for sdcard_posix context= mounts. +attribute sdcard_posix_contextmount_type; + # All types used for files that can exist on a labeled fs. # Do not use for pseudo file types. # On change, update CHECK_FC_ASSERT_ATTRS diff --git a/prebuilts/api/34.0/public/domain.te b/prebuilts/api/34.0/public/domain.te index d4be2056f..4f8dc7a93 100644 --- a/prebuilts/api/34.0/public/domain.te +++ b/prebuilts/api/34.0/public/domain.te @@ -491,7 +491,7 @@ neverallow * rootfs:file { create write setattr relabelto append unlink link ren # Restrict context mounts to specific types marked with # the contextmount_type attribute. -neverallow * {fs_type -contextmount_type}:filesystem relabelto; +neverallow * {fs_type -contextmount_type -sdcard_posix_contextmount_type}:filesystem relabelto; # Ensure that context mount types are not writable, to ensure that # the write to /system restriction above is not bypassed via context= diff --git a/public/attributes b/public/attributes index 759b773a2..9cd89fa33 100644 --- a/public/attributes +++ b/public/attributes @@ -27,6 +27,9 @@ attribute contextmount_type; # example. attribute fusefs_type; +# All types used for sdcard_posix context= mounts. +attribute sdcard_posix_contextmount_type; + # All types used for files that can exist on a labeled fs. # Do not use for pseudo file types. # On change, update CHECK_FC_ASSERT_ATTRS