75806ef3c5
Ideally, public should only contain APIs (types / attributes) for
vendor. The other statements like allow/neverallow/typeattributes are
regarded as implementation detail for platform and should be in private.
Bug: 232023812
Test: m selinux_policy
Test: diff <(git diff --staged | grep "^-" | cut -b2- | sort) \
<(git diff --staged | grep "^+" | cut -b2- | sort)
Test: remove comments on plat_sepolicy.cil, replace base_typeattr_*
to base_typeattr and then compare old and new plat_sepolicy.cil
Change-Id: I5e7d2da4465ab0216de6bacdf03077d37f6ffe12
38 lines
1.4 KiB
Text
38 lines
1.4 KiB
Text
typeattribute sgdisk coredomain;
|
|
|
|
# Allowed to read/write low-level partition tables
|
|
allow sgdisk block_device:dir search;
|
|
allow sgdisk vold_device:blk_file rw_file_perms;
|
|
# HDIO_GETGEO needed to get the number of disk heads
|
|
# on vold_device. How quaint.
|
|
allowxperm sgdisk vold_device:blk_file ioctl { HDIO_GETGEO };
|
|
# sgdisk also uses BLKGETSIZE and BLKGETSIZE64. BLKGETSIZE64
|
|
# is granted to all block device users in domain.te, so
|
|
# no need to mention it here. sgdisk should not be
|
|
# using the BLKGETSIZE ioctl as it is useless for devices over
|
|
# 2T in size, but we allow it for now and hope that sgdisk
|
|
# will fix their bug.
|
|
allowxperm sgdisk vold_device:blk_file ioctl { BLKGETSIZE };
|
|
# Force a re-read of the partition table.
|
|
allowxperm sgdisk vold_device:blk_file ioctl { BLKRRPART };
|
|
# Allow reading of the physical block size.
|
|
allowxperm sgdisk vold_device:blk_file ioctl { BLKPBSZGET };
|
|
|
|
# Inherit and use pty created by android_fork_execvp()
|
|
allow sgdisk devpts:chr_file { read write ioctl getattr };
|
|
|
|
# Allow stdin/out back to vold
|
|
allow sgdisk vold:fd use;
|
|
allow sgdisk vold:fifo_file { read write getattr };
|
|
|
|
# Used to probe kernel to reload partition tables
|
|
allow sgdisk self:global_capability_class_set sys_admin;
|
|
|
|
###
|
|
### Neverallow rules
|
|
###
|
|
|
|
# Only allow entry from vold
|
|
neverallow { domain -vold } sgdisk:process transition;
|
|
neverallow * sgdisk:process dyntransition;
|
|
neverallow sgdisk { file_type fs_type -sgdisk_exec }:file entrypoint;
|