| Inseob Kim | e138997 | 2021-07-19 07:48:34 +0000 | [diff] [blame] | 1 | typeattribute ueventd coredomain; |
| 2 | |
| 3 | tmpfs_domain(ueventd) |
| 4 | |
| 5 | # Write to /dev/kmsg. |
| 6 | allow ueventd kmsg_device:chr_file rw_file_perms; |
| 7 | |
| 8 | allow ueventd self:global_capability_class_set { chown mknod net_admin setgid fsetid sys_rawio dac_override dac_read_search fowner setuid }; |
| 9 | allow ueventd device:file create_file_perms; |
| 10 | |
| 11 | r_dir_file(ueventd, rootfs) |
| 12 | |
| 13 | # ueventd needs write access to files in /sys to regenerate uevents |
| 14 | allow ueventd sysfs_type:file w_file_perms; |
| 15 | r_dir_file(ueventd, sysfs_type) |
| 16 | allow ueventd sysfs_type:{ file lnk_file } { relabelfrom relabelto setattr }; |
| 17 | allow ueventd sysfs_type:dir { relabelfrom relabelto setattr }; |
| 18 | allow ueventd tmpfs:chr_file rw_file_perms; |
| 19 | allow ueventd dev_type:dir create_dir_perms; |
| 20 | allow ueventd dev_type:lnk_file { create unlink }; |
| 21 | allow ueventd dev_type:chr_file { getattr create setattr unlink }; |
| 22 | allow ueventd dev_type:blk_file { getattr relabelfrom relabelto create setattr unlink }; |
| 23 | allow ueventd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; |
| 24 | |
| 25 | # Get SELinux enforcing status. |
| 26 | r_dir_file(ueventd, selinuxfs) |
| 27 | |
| 28 | # Access for /vendor/ueventd.rc and /vendor/firmware |
| 29 | r_dir_file(ueventd, vendor_file_type) |
| 30 | |
| 31 | # Access for /apex/*/firmware |
| 32 | allow ueventd apex_mnt_dir:dir r_dir_perms; |
| 33 | |
| 34 | # Get file contexts for new device nodes |
| 35 | allow ueventd file_contexts_file:file r_file_perms; |
| 36 | |
| 37 | # Use setfscreatecon() to label /dev directories and files. |
| 38 | allow ueventd self:process setfscreate; |
| 39 | |
| 40 | # Allow ueventd to read androidboot.android_dt_dir from kernel cmdline or bootconfig. |
| 41 | allow ueventd proc_cmdline:file r_file_perms; |
| 42 | allow ueventd proc_bootconfig:file r_file_perms; |
| 43 | |
| 44 | # ueventd loads modules in response to modalias events. |
| 45 | allow ueventd self:global_capability_class_set sys_module; |
| 46 | allow ueventd vendor_file:system module_load; |
| 47 | allow ueventd kernel:key search; |
| 48 | |
| 49 | # ueventd is using bootstrap bionic |
| 50 | allow ueventd system_bootstrap_lib_file:dir r_dir_perms; |
| 51 | allow ueventd system_bootstrap_lib_file:file { execute read open getattr map }; |
| 52 | |
| Inseob Kim | 0abc4fd | 2021-08-04 10:58:22 +0000 | [diff] [blame] | 53 | # TODO(b/193118220): find out why this happens. |
| 54 | dontaudit ueventd tmpfs:chr_file { relabelfrom setattr }; |
| Inseob Kim | 5ee61a7 | 2021-09-17 19:31:45 +0900 | [diff] [blame] | 55 | |
| 56 | # ueventd sets ro.cold_boot_done to signal to init that cold boot has completed. |
| 57 | set_prop(ueventd, cold_boot_done_prop) |