7c34e83fcd
This attribute is being actively removed from policy. Since
attributes are not being versioned, partners must not be able to
access and use this attribute. Move it from private and verify in
the logs that rild and tee are not using these permissions.
Bug: 38316109
Test: build and boot Marlin
Test: Verify that rild and tee are not being granted any of these
permissions.
Merged-In: I31beeb5bdf3885195310b086c1af3432dc6a349b
Change-Id: I31beeb5bdf3885195310b086c1af3432dc6a349b
(cherry picked from commit 76aab82cb3)
20 lines
814 B
Text
20 lines
814 B
Text
typeattribute vold coredomain;
|
|
typeattribute vold domain_deprecated;
|
|
|
|
init_daemon_domain(vold)
|
|
|
|
# Switch to more restrictive domains when executing common tools
|
|
domain_auto_trans(vold, sgdisk_exec, sgdisk);
|
|
domain_auto_trans(vold, sdcardd_exec, sdcardd);
|
|
|
|
# For a handful of probing tools, we choose an even more restrictive
|
|
# domain when working with untrusted block devices
|
|
domain_trans(vold, shell_exec, blkid);
|
|
domain_trans(vold, shell_exec, blkid_untrusted);
|
|
domain_trans(vold, fsck_exec, fsck);
|
|
domain_trans(vold, fsck_exec, fsck_untrusted);
|
|
|
|
# Newly created storage dirs are always treated as mount stubs to prevent us
|
|
# from accidentally writing when the mount point isn't present.
|
|
type_transition vold storage_file:dir storage_stub_file;
|
|
type_transition vold mnt_media_rw_file:dir mnt_media_rw_stub_file;
|