aa898dc541
We have moved the encryption policy assignment from vold to vold_prepare_subdirs. This CL removes some permissions from vold over storage areas that are no longer needed due to this change, and adds some permissions to vold_prepare_subdirs. Bug: 325129836 Test: atest StorageAreaTest Change-Id: Ief2a8021ed3524018d001e20eae60f712f485d81
101 lines
3.4 KiB
Text
101 lines
3.4 KiB
Text
domain_auto_trans(vold, vold_prepare_subdirs_exec, vold_prepare_subdirs)
|
|
|
|
typeattribute vold_prepare_subdirs coredomain;
|
|
typeattribute vold_prepare_subdirs mlstrustedsubject;
|
|
|
|
allow vold_prepare_subdirs system_file:file execute_no_trans;
|
|
allow vold_prepare_subdirs shell_exec:file rx_file_perms;
|
|
allow vold_prepare_subdirs toolbox_exec:file rx_file_perms;
|
|
allow vold_prepare_subdirs devpts:chr_file rw_file_perms;
|
|
allow vold_prepare_subdirs vold:fd use;
|
|
allow vold_prepare_subdirs vold:fifo_file { read write };
|
|
allow vold_prepare_subdirs file_contexts_file:file r_file_perms;
|
|
allow vold_prepare_subdirs seapp_contexts_file:file r_file_perms;
|
|
allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override dac_read_search fowner };
|
|
allow vold_prepare_subdirs self:process setfscreate;
|
|
allow vold_prepare_subdirs {
|
|
sdk_sandbox_system_data_file
|
|
system_data_file
|
|
vendor_data_file
|
|
}:dir { open read write add_name remove_name rmdir relabelfrom };
|
|
allow vold_prepare_subdirs {
|
|
apex_data_file_type
|
|
apex_module_data_file
|
|
apex_rollback_data_file
|
|
backup_data_file
|
|
checkin_data_file
|
|
face_vendor_data_file
|
|
fingerprint_vendor_data_file
|
|
iris_vendor_data_file
|
|
rollback_data_file
|
|
is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_key_file')
|
|
storaged_data_file
|
|
sdk_sandbox_data_file
|
|
sdk_sandbox_system_data_file
|
|
system_data_file
|
|
vold_data_file
|
|
}:dir { create_dir_perms relabelto };
|
|
allow vold_prepare_subdirs {
|
|
apex_data_file_type
|
|
apex_art_staging_data_file
|
|
apex_module_data_file
|
|
apex_rollback_data_file
|
|
backup_data_file
|
|
checkin_data_file
|
|
face_vendor_data_file
|
|
fingerprint_vendor_data_file
|
|
iris_vendor_data_file
|
|
rollback_data_file
|
|
storaged_data_file
|
|
sdk_sandbox_data_file
|
|
system_data_file
|
|
vold_data_file
|
|
}:file { getattr unlink };
|
|
allow vold_prepare_subdirs apex_mnt_dir:dir { open read };
|
|
allow vold_prepare_subdirs mnt_expand_file:dir search;
|
|
allow vold_prepare_subdirs user_profile_data_file:dir { search getattr relabelfrom };
|
|
allow vold_prepare_subdirs user_profile_root_file:dir { search getattr relabelfrom relabelto };
|
|
|
|
# Allow vold_prepare_subdirs to create storage area directories on behalf of apps.
|
|
is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
|
|
allow vold_prepare_subdirs {
|
|
storage_area_dir
|
|
storage_area_app_dir
|
|
}:dir {
|
|
rw_dir_perms
|
|
create
|
|
setattr # for chown() and chmod()
|
|
rmdir
|
|
unlink
|
|
relabelfrom # setfilecon
|
|
relabelto # setfilecon
|
|
};
|
|
|
|
# The storage area directories should have type storage_area_dir
|
|
type_transition vold_prepare_subdirs storage_area_app_dir:dir storage_area_dir;
|
|
|
|
selinux_check_context(vold_prepare_subdirs)
|
|
|
|
allowxperm vold_prepare_subdirs storage_area_dir:dir ioctl FS_IOC_SET_ENCRYPTION_POLICY;
|
|
')
|
|
|
|
is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `
|
|
neverallowxperm vold_prepare_subdirs {
|
|
data_file_type
|
|
-storage_area_dir
|
|
}:dir ioctl FS_IOC_SET_ENCRYPTION_POLICY;
|
|
')
|
|
|
|
# Migrate legacy labels to apex_system_server_data_file (b/217581286)
|
|
allow vold_prepare_subdirs {
|
|
apex_appsearch_data_file
|
|
apex_permission_data_file
|
|
apex_scheduling_data_file
|
|
apex_tethering_data_file
|
|
apex_wifi_data_file
|
|
}:dir relabelfrom;
|
|
|
|
# /data/misc is unlabeled during early boot.
|
|
allow vold_prepare_subdirs unlabeled:dir search;
|
|
|
|
dontaudit vold_prepare_subdirs { proc unlabeled }:file r_file_perms;
|