Merge "Remove block device access from unconfined domains."
diff --git a/domain.te b/domain.te
index 13ce016..5ac6b46 100644
--- a/domain.te
+++ b/domain.te
@@ -203,7 +203,7 @@
# Don't allow raw read/write/open access to block_device
# Rather force a relabel to a more specific type
-neverallow { domain -unconfineddomain -vold } block_device:blk_file { open read write };
+neverallow { domain -kernel -init -recovery -vold } block_device:blk_file { open read write };
# Don't allow raw read/write/open access to generic devices.
# Rather force a relabel to a more specific type.
diff --git a/init.te b/init.te
index efce6e7..c05faba 100644
--- a/init.te
+++ b/init.te
@@ -9,6 +9,7 @@
allow init self:capability { sys_rawio mknod };
+allow init dev_type:blk_file rw_file_perms;
allow init fs_type:filesystem *;
allow init {fs_type dev_type file_type}:dir_file_class_set relabelto;
allow init kernel:security load_policy;
diff --git a/kernel.te b/kernel.te
index af10791..88ebc50 100644
--- a/kernel.te
+++ b/kernel.te
@@ -21,3 +21,5 @@
## TODO: Investigate whether it is safe to remove these
allow kernel self:capability { sys_rawio mknod };
auditallow kernel self:capability { sys_rawio mknod };
+allow kernel dev_type:blk_file rw_file_perms;
+auditallow kernel dev_type:blk_file rw_file_perms;
diff --git a/recovery.te b/recovery.te
index ea444c4..b6f82c7 100644
--- a/recovery.te
+++ b/recovery.te
@@ -10,6 +10,9 @@
allow recovery unlabeled:filesystem mount;
allow recovery fs_type:filesystem *;
+# Required to e.g. wipe userdata/cache.
+allow recovery dev_type:blk_file rw_file_perms;
+
allow recovery self:process execmem;
allow recovery ashmem_device:chr_file execute;
allow recovery tmpfs:file rx_file_perms;
diff --git a/unconfined.te b/unconfined.te
index 8415ada..80d42b3 100644
--- a/unconfined.te
+++ b/unconfined.te
@@ -28,7 +28,7 @@
allow unconfineddomain domain:socket_class_set *;
allow unconfineddomain domain:ipc_class_set *;
allow unconfineddomain domain:key *;
-allow unconfineddomain {fs_type dev_type file_type}:{ dir blk_file lnk_file sock_file fifo_file } ~relabelto;
+allow unconfineddomain {fs_type dev_type file_type}:{ dir lnk_file sock_file fifo_file } ~relabelto;
allow unconfineddomain {fs_type -usermodehelper -proc_security}:{ chr_file file } ~{entrypoint execmod execute relabelto};
allow unconfineddomain {dev_type -kmem_device}:{ chr_file file } ~{entrypoint execmod execute relabelto};
allow unconfineddomain file_type:{ chr_file file } ~{entrypoint execmod execute relabelto};