e4c966648e
Bug: 138322712 Test: No denial for chattr on boot Change-Id: I9fdfc8ff4d3d0b2743ca572f4c3e64477f97cd84
38 lines
1.4 KiB
Text
38 lines
1.4 KiB
Text
# Any toolbox command run by init.
|
|
# At present, the only known usage is for running mkswap via fs_mgr.
|
|
# Do NOT use this domain for toolbox when run by any other domain.
|
|
type toolbox, domain;
|
|
type toolbox_exec, system_file_type, exec_type, file_type;
|
|
|
|
# /dev/__null__ created by init prior to policy load,
|
|
# open fd inherited by fsck.
|
|
allow toolbox tmpfs:chr_file { read write ioctl };
|
|
|
|
# Inherit and use pty created by android_fork_execvp_ext().
|
|
allow toolbox devpts:chr_file { read write getattr ioctl };
|
|
|
|
# mkswap-specific.
|
|
# Read/write block devices used for swap partitions.
|
|
# Assign swap_block_device type any such partition in your
|
|
# device/<vendor>/<product>/sepolicy/file_contexts file.
|
|
allow toolbox block_device:dir search;
|
|
allow toolbox swap_block_device:blk_file rw_file_perms;
|
|
|
|
# Only allow entry from init via the toolbox binary.
|
|
neverallow { domain -init } toolbox:process transition;
|
|
neverallow * toolbox:process dyntransition;
|
|
neverallow toolbox { file_type fs_type -toolbox_exec}:file entrypoint;
|
|
|
|
# rm -rf directories in /data
|
|
allow toolbox system_data_root_file:dir { remove_name write };
|
|
allow toolbox system_data_file:dir { rmdir rw_dir_perms };
|
|
allow toolbox system_data_file:file { getattr unlink };
|
|
|
|
# chattr +F and chattr +P /data/media in init
|
|
allow toolbox media_rw_data_file:dir { r_dir_perms setattr };
|
|
allowxperm toolbox media_rw_data_file:dir ioctl {
|
|
FS_IOC_FSGETXATTR
|
|
FS_IOC_FSSETXATTR
|
|
FS_IOC_GETFLAGS
|
|
FS_IOC_SETFLAGS
|
|
};
|