Merge "platform_app.te: remove obsolete rules."
diff --git a/private/domain.te b/private/domain.te
index c975ce6..b0c7ac7 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -5,6 +5,7 @@
-debuggerd
-vold
-dumpstate
+ -storaged
-system_server
userdebug_or_eng(`-perfprofd')
} self:capability sys_ptrace;
diff --git a/private/dumpstate.te b/private/dumpstate.te
index a54591d..6a66293 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -13,3 +13,7 @@
allow dumpstate debugfs_tracing:file rw_file_perms;
allow dumpstate debugfs_trace_marker:file getattr;
allow dumpstate atrace_exec:file rx_file_perms;
+allow dumpstate storaged_exec:file rx_file_perms;
+
+# Allow dumpstate to make binder calls to storaged service
+binder_call(dumpstate, storaged)
diff --git a/private/file_contexts b/private/file_contexts
index f6399fb..80e1927 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -227,6 +227,7 @@
/system/bin/idmap u:object_r:idmap_exec:s0
/system/bin/update_engine u:object_r:update_engine_exec:s0
/system/bin/bspatch u:object_r:update_engine_exec:s0
+/system/bin/storaged u:object_r:storaged_exec:s0
/system/bin/webview_zygote32 u:object_r:webview_zygote_exec:s0
/system/bin/webview_zygote64 u:object_r:webview_zygote_exec:s0
/system/fake-lib(64)?/libart.* u:object_r:libart_file:s0
@@ -422,6 +423,7 @@
#############################
# debugfs files
#
+/sys/kernel/debug/mmc0(/.*)? u:object_r:debugfs_mmc:s0
/sys/kernel/debug/tracing(/.*)? u:object_r:debugfs_tracing:s0
/sys/kernel/debug/tracing/trace_marker u:object_r:debugfs_trace_marker:s0
diff --git a/private/priv_app.te b/private/priv_app.te
index 9cb287d..2c28b18 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -2,8 +2,6 @@
### A domain for further sandboxing privileged apps.
###
-typeattribute priv_app domain_deprecated;
-
app_domain(priv_app)
# Access the network.
diff --git a/private/service_contexts b/private/service_contexts
index 2f31393..5414f11 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -133,6 +133,7 @@
sip u:object_r:radio_service:s0
soundtrigger u:object_r:voiceinteraction_service:s0
statusbar u:object_r:statusbar_service:s0
+storaged u:object_r:storaged_service:s0
SurfaceFlinger u:object_r:surfaceflinger_service:s0
task u:object_r:task_service:s0
telecom u:object_r:telecom_service:s0
diff --git a/private/storaged.te b/private/storaged.te
new file mode 100644
index 0000000..bf5c242
--- /dev/null
+++ b/private/storaged.te
@@ -0,0 +1,32 @@
+# storaged daemon
+type storaged, domain, mlstrustedsubject;
+type storaged_exec, exec_type, file_type;
+
+init_daemon_domain(storaged)
+
+# Write to /dev/kmsg (opened in init)
+allow storaged kmsg_device:chr_file { write append };
+
+# Read access to pseudo filesystems
+allow storaged proc:dir r_dir_perms;
+r_dir_file(storaged, sysfs_type)
+r_dir_file(storaged, proc_net)
+r_dir_file(storaged, domain)
+
+allow storaged self:capability { setgid setuid sys_nice sys_ptrace };
+
+userdebug_or_eng(`
+ # Read access to debugfs
+ allow storaged debugfs_mmc:dir search;
+ allow storaged debugfs_mmc:file r_file_perms;
+')
+
+# Binder permissions
+allow storaged storaged_service:service_manager add;
+binder_use(storaged)
+binder_call(storaged, system_server)
+
+###
+### neverallow
+###
+neverallow storaged domain:process ptrace;
diff --git a/public/domain_deprecated.te b/public/domain_deprecated.te
index 13b18fa..d092d09 100644
--- a/public/domain_deprecated.te
+++ b/public/domain_deprecated.te
@@ -17,9 +17,9 @@
allow domain_deprecated rootfs:dir r_dir_perms;
allow domain_deprecated rootfs:file r_file_perms;
allow domain_deprecated rootfs:lnk_file r_file_perms;
-auditallow { domain_deprecated -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:dir { open getattr read ioctl lock }; # search granted in domain
-auditallow { domain_deprecated -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:file r_file_perms;
-auditallow { domain_deprecated -appdomain -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:lnk_file { getattr open ioctl lock }; # read granted in domain
+auditallow { domain_deprecated -healthd -init -installd -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:dir { open getattr read ioctl lock }; # search granted in domain
+auditallow { domain_deprecated -healthd -init -installd -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:file r_file_perms;
+auditallow { domain_deprecated -appdomain -healthd -init -installd -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:lnk_file { getattr open ioctl lock }; # read granted in domain
# System file accesses.
allow domain_deprecated system_file:dir r_dir_perms;
@@ -63,9 +63,9 @@
allow domain_deprecated cache_file:dir r_dir_perms;
allow domain_deprecated cache_file:file { getattr read };
allow domain_deprecated cache_file:lnk_file r_file_perms;
-auditallow { domain_deprecated -init -priv_app -system_server -vold } cache_file:dir { open read search ioctl lock };
-auditallow { domain_deprecated -appdomain -init -priv_app -system_server -vold } cache_file:dir getattr;
-auditallow { domain_deprecated -init -priv_app -system_server -vold } cache_file:file { getattr read };
+auditallow { domain_deprecated -init -system_server -vold } cache_file:dir { open read search ioctl lock };
+auditallow { domain_deprecated -appdomain -init -system_server -vold } cache_file:dir getattr;
+auditallow { domain_deprecated -init -system_server -vold } cache_file:file { getattr read };
auditallow { domain_deprecated -init -system_server -vold } cache_file:lnk_file r_file_perms;
#Allow access to ion memory allocation device
@@ -81,11 +81,11 @@
r_dir_file(domain_deprecated, cgroup)
allow domain_deprecated proc_meminfo:file r_file_perms;
#auditallow domain_deprecated proc:dir r_dir_perms; # r_dir_perms granted in domain
-auditallow { domain_deprecated -fsck -fsck_untrusted -init -priv_app -rild -system_server -vold } proc:file r_file_perms;
-auditallow { domain_deprecated -fsck -fsck_untrusted -init -priv_app -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain
-auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:dir { open getattr read ioctl lock }; # search granted in domain
-auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:file r_file_perms;
-auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain
+auditallow { domain_deprecated -fsck -fsck_untrusted -init -rild -system_server -vold } proc:file r_file_perms;
+auditallow { domain_deprecated -fsck -fsck_untrusted -init -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain
+auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:dir { open getattr read ioctl lock }; # search granted in domain
+auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:file r_file_perms;
+auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain
auditallow {
domain_deprecated
-appdomain
@@ -118,7 +118,7 @@
-system_server
-zygote
} cgroup:{ file lnk_file } r_file_perms;
-auditallow { domain_deprecated -appdomain -init -priv_app -surfaceflinger -system_server -vold } proc_meminfo:file r_file_perms;
+auditallow { domain_deprecated -appdomain -init -surfaceflinger -system_server -vold } proc_meminfo:file r_file_perms;
# Get SELinux enforcing status.
allow domain_deprecated selinuxfs:dir r_dir_perms;
diff --git a/public/file.te b/public/file.te
index 6184eef..0365dc9 100644
--- a/public/file.te
+++ b/public/file.te
@@ -57,6 +57,7 @@
type sdcardfs, sdcard_type, fs_type, mlstrustedobject;
type vfat, sdcard_type, fs_type, mlstrustedobject;
type debugfs, fs_type;
+type debugfs_mmc, fs_type, debugfs_type;
type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject;
type debugfs_tracing, fs_type, debugfs_type;
type pstorefs, fs_type;
diff --git a/public/service.te b/public/service.te
index 550f79b..376208e 100644
--- a/public/service.te
+++ b/public/service.te
@@ -19,6 +19,7 @@
type netd_service, service_manager_type;
type nfc_service, service_manager_type;
type radio_service, service_manager_type;
+type storaged_service, service_manager_type;
type surfaceflinger_service, service_manager_type;
type system_app_service, service_manager_type;
type update_engine_service, service_manager_type;