Alex Klyubin | f5446eb | 2017-03-23 14:27:32 -0700 | [diff] [blame] | 1 | typeattribute toolbox coredomain; |
| 2 | |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 3 | init_daemon_domain(toolbox) |
Alan Stokes | c88f0ef | 2022-04-27 17:26:57 +0100 | [diff] [blame] | 4 | |
| 5 | # rm -rf in /data/misc/virtualizationservice |
| 6 | allow toolbox virtualizationservice_data_file:dir { rmdir rw_dir_perms }; |
| 7 | allow toolbox virtualizationservice_data_file:file { getattr unlink }; |
Alan Stokes | 40f33c1 | 2022-06-15 17:25:20 +0100 | [diff] [blame] | 8 | |
| 9 | # If we can't remove these directories we try to chmod them. That |
| 10 | # doesn't work, but it doesn't matter as virtualizationservice itself |
| 11 | # will delete them when it starts. See b/235338094#comment39 |
| 12 | dontaudit toolbox virtualizationservice_data_file:dir setattr; |
Inseob Kim | 75806ef | 2024-03-27 17:18:41 +0900 | [diff] [blame^] | 13 | |
| 14 | # /dev/__null__ created by init prior to policy load, |
| 15 | # open fd inherited by fsck. |
| 16 | allow toolbox tmpfs:chr_file { read write ioctl }; |
| 17 | |
| 18 | # Inherit and use pty created by android_fork_execvp_ext(). |
| 19 | allow toolbox devpts:chr_file { read write getattr ioctl }; |
| 20 | |
| 21 | # mkswap-specific. |
| 22 | # Read/write block devices used for swap partitions. |
| 23 | # Assign swap_block_device type any such partition in your |
| 24 | # device/<vendor>/<product>/sepolicy/file_contexts file. |
| 25 | allow toolbox block_device:dir search; |
| 26 | allow toolbox swap_block_device:blk_file rw_file_perms; |
| 27 | |
| 28 | # rm -rf /data/per_boot |
| 29 | allow toolbox system_data_root_file:dir { remove_name write }; |
| 30 | allow toolbox system_data_file:dir { rmdir rw_dir_perms }; |
| 31 | allow toolbox system_data_file:file { getattr unlink }; |
| 32 | |
| 33 | # chattr +F /data/media in init |
| 34 | allow toolbox media_userdir_file:dir { r_dir_perms setattr }; |
| 35 | allowxperm toolbox media_userdir_file:dir ioctl { FS_IOC_SETFLAGS FS_IOC_GETFLAGS }; |
| 36 | |
| 37 | ### |
| 38 | ### Neverallow rules |
| 39 | ### |
| 40 | |
| 41 | # Only allow entry from init via the toolbox binary. |
| 42 | neverallow { domain -init } toolbox:process transition; |
| 43 | neverallow * toolbox:process dyntransition; |
| 44 | neverallow toolbox { file_type fs_type -toolbox_exec}:file entrypoint; |