d22987b4da
Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
22 lines
764 B
Text
22 lines
764 B
Text
# sgdisk called from vold
|
|
type sgdisk, domain, domain_deprecated;
|
|
type sgdisk_exec, exec_type, file_type;
|
|
|
|
# Allowed to read/write low-level partition tables
|
|
allow sgdisk block_device:dir search;
|
|
allow sgdisk vold_device:blk_file rw_file_perms;
|
|
|
|
# Inherit and use pty created by android_fork_execvp()
|
|
allow sgdisk devpts:chr_file { read write ioctl getattr };
|
|
|
|
# Allow stdin/out back to vold
|
|
allow sgdisk vold:fd use;
|
|
allow sgdisk vold:fifo_file { read write getattr };
|
|
|
|
# Used to probe kernel to reload partition tables
|
|
allow sgdisk self:capability sys_admin;
|
|
|
|
# Only allow entry from vold
|
|
neverallow { domain -vold } sgdisk:process transition;
|
|
neverallow domain sgdisk:process dyntransition;
|
|
neverallow sgdisk { file_type fs_type -sgdisk_exec }:file entrypoint;
|