| Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 1 | # storaged daemon |
| 2 | type storaged, domain, coredomain, mlstrustedsubject; |
| 3 | type storaged_exec, exec_type, file_type; |
| 4 | |
| 5 | init_daemon_domain(storaged) |
| 6 | |
| 7 | # Read access to pseudo filesystems |
| 8 | r_dir_file(storaged, sysfs_type) |
| 9 | r_dir_file(storaged, proc_net) |
| 10 | r_dir_file(storaged, domain) |
| 11 | |
| 12 | # Read /proc/uid_io/stats |
| 13 | allow storaged proc_uid_io_stats:file r_file_perms; |
| 14 | |
| 15 | # Read /data/system/packages.list |
| 16 | allow storaged system_data_file:file r_file_perms; |
| 17 | |
| 18 | userdebug_or_eng(` |
| 19 | # Read access to debugfs |
| 20 | allow storaged debugfs_mmc:dir search; |
| 21 | allow storaged debugfs_mmc:file r_file_perms; |
| 22 | ') |
| 23 | |
| 24 | # Needed to provide debug dump output via dumpsys pipes. |
| 25 | allow storaged shell:fd use; |
| 26 | allow storaged shell:fifo_file write; |
| 27 | |
| 28 | # Needed for GMScore to call dumpsys storaged |
| 29 | allow storaged priv_app:fd use; |
| 30 | allow storaged app_data_file:file write; |
| 31 | allow storaged permission_service:service_manager find; |
| 32 | |
| 33 | # Binder permissions |
| 34 | add_service(storaged, storaged_service) |
| 35 | |
| 36 | binder_use(storaged) |
| 37 | binder_call(storaged, system_server) |
| 38 | |
| 39 | # use batteryproperties service |
| 40 | allow storaged batteryproperties_service:service_manager find; |
| 41 | binder_call(storaged, healthd) |
| 42 | |
| 43 | # Kernel does extra check on CAP_DAC_OVERRIDE for libbinder when storaged is |
| 44 | # running as root. See b/35323867 #3. |
| 45 | dontaudit storaged self:capability dac_override; |
| 46 | |
| 47 | ### |
| 48 | ### neverallow |
| 49 | ### |
| 50 | neverallow storaged domain:process ptrace; |
| 51 | neverallow storaged self:capability_class_set *; |