b729aa6c5e
Checkin apps use /data/misc_ce/<id>/checkin to backup the checkin metadata. So users won't lose the checkin tokens when they clear the app's storage. One example is when GMScore is used for checkin, users may clear GMScore data via "settings". If the device accidentally loses the token without backup, it won't be able to checkin again until factory reset. The contents in checkin dir will be cleaned up when a user is removed from the device. We also plan to add Gmscore test to ensure the dir is cleaned up at checkin time, thus prevent other Gmscore modules from using this storage by mistake. Bug: 197636740 Test: boot device, check selinux label, check gmscore writes to the new dir Change-Id: If3ff5e0fb75b4d49ce80d91b0086b58db002e4fb
54 lines
2 KiB
Text
54 lines
2 KiB
Text
domain_auto_trans(vold, vold_prepare_subdirs_exec, vold_prepare_subdirs)
|
|
|
|
typeattribute vold_prepare_subdirs mlstrustedsubject;
|
|
|
|
allow vold_prepare_subdirs system_file:file execute_no_trans;
|
|
allow vold_prepare_subdirs shell_exec:file rx_file_perms;
|
|
allow vold_prepare_subdirs toolbox_exec:file rx_file_perms;
|
|
allow vold_prepare_subdirs devpts:chr_file rw_file_perms;
|
|
allow vold_prepare_subdirs vold:fd use;
|
|
allow vold_prepare_subdirs vold:fifo_file { read write };
|
|
allow vold_prepare_subdirs file_contexts_file:file r_file_perms;
|
|
allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override dac_read_search fowner };
|
|
allow vold_prepare_subdirs self:process setfscreate;
|
|
allow vold_prepare_subdirs {
|
|
system_data_file
|
|
vendor_data_file
|
|
}:dir { open read write add_name remove_name rmdir relabelfrom };
|
|
allow vold_prepare_subdirs {
|
|
apex_data_file_type
|
|
apex_module_data_file
|
|
apex_rollback_data_file
|
|
backup_data_file
|
|
checkin_data_file
|
|
face_vendor_data_file
|
|
fingerprint_vendor_data_file
|
|
iris_vendor_data_file
|
|
rollback_data_file
|
|
storaged_data_file
|
|
system_data_file
|
|
vold_data_file
|
|
}:dir { create_dir_perms relabelto };
|
|
allow vold_prepare_subdirs {
|
|
apex_data_file_type
|
|
apex_art_staging_data_file
|
|
apex_module_data_file
|
|
apex_rollback_data_file
|
|
backup_data_file
|
|
checkin_data_file
|
|
face_vendor_data_file
|
|
fingerprint_vendor_data_file
|
|
iris_vendor_data_file
|
|
rollback_data_file
|
|
storaged_data_file
|
|
system_data_file
|
|
vold_data_file
|
|
}:file { getattr unlink };
|
|
allow vold_prepare_subdirs apex_mnt_dir:dir { open read };
|
|
allow vold_prepare_subdirs mnt_expand_file:dir search;
|
|
allow vold_prepare_subdirs user_profile_data_file:dir { search getattr relabelfrom };
|
|
allow vold_prepare_subdirs user_profile_root_file:dir { search getattr relabelfrom relabelto };
|
|
# /data/misc is unlabeled during early boot.
|
|
allow vold_prepare_subdirs unlabeled:dir search;
|
|
|
|
dontaudit vold_prepare_subdirs { proc unlabeled }:file r_file_perms;
|