blob: 265db0a5ae75db29c8501a7ac8a47b587f396ac3 [file] [log] [blame]
Alex Klyubinf5446eb2017-03-23 14:27:32 -07001typeattribute toolbox coredomain;
2
dcashmancc39f632016-07-22 13:13:11 -07003init_daemon_domain(toolbox)
Alan Stokesc88f0ef2022-04-27 17:26:57 +01004
5# rm -rf in /data/misc/virtualizationservice
6allow toolbox virtualizationservice_data_file:dir { rmdir rw_dir_perms };
7allow toolbox virtualizationservice_data_file:file { getattr unlink };
Alan Stokes40f33c12022-06-15 17:25:20 +01008
9# If we can't remove these directories we try to chmod them. That
10# doesn't work, but it doesn't matter as virtualizationservice itself
11# will delete them when it starts. See b/235338094#comment39
12dontaudit toolbox virtualizationservice_data_file:dir setattr;
Inseob Kim75806ef2024-03-27 17:18:41 +090013
14# /dev/__null__ created by init prior to policy load,
15# open fd inherited by fsck.
16allow toolbox tmpfs:chr_file { read write ioctl };
17
18# Inherit and use pty created by android_fork_execvp_ext().
19allow toolbox devpts:chr_file { read write getattr ioctl };
20
21# mkswap-specific.
22# Read/write block devices used for swap partitions.
23# Assign swap_block_device type any such partition in your
24# device/<vendor>/<product>/sepolicy/file_contexts file.
25allow toolbox block_device:dir search;
26allow toolbox swap_block_device:blk_file rw_file_perms;
27
28# rm -rf /data/per_boot
29allow toolbox system_data_root_file:dir { remove_name write };
30allow toolbox system_data_file:dir { rmdir rw_dir_perms };
31allow toolbox system_data_file:file { getattr unlink };
32
33# chattr +F /data/media in init
34allow toolbox media_userdir_file:dir { r_dir_perms setattr };
35allowxperm toolbox media_userdir_file:dir ioctl { FS_IOC_SETFLAGS FS_IOC_GETFLAGS };
36
37###
38### Neverallow rules
39###
40
41# Only allow entry from init via the toolbox binary.
42neverallow { domain -init } toolbox:process transition;
43neverallow * toolbox:process dyntransition;
44neverallow toolbox { file_type fs_type -toolbox_exec}:file entrypoint;