Gitiles
Code Review Sign In
gerrit.omnirom.org / android_system_sepolicy / 75806ef3c529c019ab002072cca7951b91f245aa / . / private / vold_prepare_subdirs.te
blob: 4d8c80266107fb55600cbb3eff30c80aef86f60e [file] [log] [blame]
Paul Crowley5b962cf2017-10-13 14:54:32 -0700[diff] [blame]1domain_auto_trans(vold, vold_prepare_subdirs_exec, vold_prepare_subdirs)
Jin Qianc0125332017-10-19 14:41:37 -0700[diff] [blame]2
Inseob Kim75806ef2024-03-27 17:18:41 +0900[diff] [blame^]3typeattribute vold_prepare_subdirs coredomain;
Alan Stokesfc0cab82020-02-11 14:43:05 +0000[diff] [blame]4typeattribute vold_prepare_subdirs mlstrustedsubject;
5
Paul Crowley5850a2a2017-10-25 13:03:24 -0700[diff] [blame]6allow vold_prepare_subdirs system_file:file execute_no_trans;
7allow vold_prepare_subdirs shell_exec:file rx_file_perms;
8allow vold_prepare_subdirs toolbox_exec:file rx_file_perms;
9allow vold_prepare_subdirs devpts:chr_file rw_file_perms;
10allow vold_prepare_subdirs vold:fd use;
11allow vold_prepare_subdirs vold:fifo_file { read write };
12allow vold_prepare_subdirs file_contexts_file:file r_file_perms;
Benjamin Gordon342362a2018-09-06 16:19:40 -0600[diff] [blame]13allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override dac_read_search fowner };
Paul Crowley5850a2a2017-10-25 13:03:24 -0700[diff] [blame]14allow vold_prepare_subdirs self:process setfscreate;
Jeff Vander Stoepd25ccab2018-02-07 16:29:06 -0800[diff] [blame]15allow vold_prepare_subdirs {
Mohammad Samiul Islamef1698a2022-05-11 21:43:54 +0100[diff] [blame]16 sdk_sandbox_system_data_file
Jeff Vander Stoepd25ccab2018-02-07 16:29:06 -0800[diff] [blame]17 system_data_file
18 vendor_data_file
Joel Galenson254a8722018-04-16 14:50:38 -0700[diff] [blame]19}:dir { open read write add_name remove_name rmdir relabelfrom };
Paul Crowley80966392018-04-26 13:41:13 -0700[diff] [blame]20allow vold_prepare_subdirs {
Alan Stokesfa10a142021-07-12 14:21:48 +0100[diff] [blame]21 apex_data_file_type
Oli Lan79b4e1a2019-11-19 18:10:16 +0000[diff] [blame]22 apex_module_data_file
Oli Lan91ce5b92019-12-02 18:29:48 +0000[diff] [blame]23 apex_rollback_data_file
Annie Meng4c3d11c2019-01-15 21:20:13 +0000[diff] [blame]24 backup_data_file
Tianjieb729aa62021-10-05 22:13:20 -0700[diff] [blame]25 checkin_data_file
Kevin Chyn91c25802018-11-15 15:28:07 -0800[diff] [blame]26 face_vendor_data_file
Nick Kralevich83f25e22018-11-19 18:42:11 +0000[diff] [blame]27 fingerprint_vendor_data_file
Kevin Chyn91c25802018-11-15 15:28:07 -0800[diff] [blame]28 iris_vendor_data_file
Narayan Kamath2ad229c2019-01-14 15:02:12 +0000[diff] [blame]29 rollback_data_file
Paul Crowley80966392018-04-26 13:41:13 -0700[diff] [blame]30 storaged_data_file
Nikita Ioffee2da6332022-02-21 17:55:59 +0000[diff] [blame]31 sdk_sandbox_data_file
Mohammad Samiul Islamef1698a2022-05-11 21:43:54 +0100[diff] [blame]32 sdk_sandbox_system_data_file
Alan Stokesfc0cab82020-02-11 14:43:05 +0000[diff] [blame]33 system_data_file
Paul Crowley80966392018-04-26 13:41:13 -0700[diff] [blame]34 vold_data_file
35}:dir { create_dir_perms relabelto };
36allow vold_prepare_subdirs {
Alan Stokesfa10a142021-07-12 14:21:48 +0100[diff] [blame]37 apex_data_file_type
Orion Hodson8f75f762020-10-16 15:29:55 +0100[diff] [blame]38 apex_art_staging_data_file
Oli Lan79b4e1a2019-11-19 18:10:16 +0000[diff] [blame]39 apex_module_data_file
Oli Lan91ce5b92019-12-02 18:29:48 +0000[diff] [blame]40 apex_rollback_data_file
Annie Meng4c3d11c2019-01-15 21:20:13 +0000[diff] [blame]41 backup_data_file
Tianjieb729aa62021-10-05 22:13:20 -0700[diff] [blame]42 checkin_data_file
Kevin Chyn91c25802018-11-15 15:28:07 -0800[diff] [blame]43 face_vendor_data_file
Nick Kralevich83f25e22018-11-19 18:42:11 +0000[diff] [blame]44 fingerprint_vendor_data_file
Kevin Chyn91c25802018-11-15 15:28:07 -0800[diff] [blame]45 iris_vendor_data_file
Narayan Kamath2ad229c2019-01-14 15:02:12 +0000[diff] [blame]46 rollback_data_file
Paul Crowley80966392018-04-26 13:41:13 -0700[diff] [blame]47 storaged_data_file
Nikita Ioffee2da6332022-02-21 17:55:59 +0000[diff] [blame]48 sdk_sandbox_data_file
Paul Crowley80966392018-04-26 13:41:13 -0700[diff] [blame]49 system_data_file
50 vold_data_file
51}:file { getattr unlink };
Oli Lan79b4e1a2019-11-19 18:10:16 +0000[diff] [blame]52allow vold_prepare_subdirs apex_mnt_dir:dir { open read };
Alan Stokesfc0cab82020-02-11 14:43:05 +0000[diff] [blame]53allow vold_prepare_subdirs mnt_expand_file:dir search;
Alan Stokes7aa40412020-12-04 14:07:52 +0000[diff] [blame]54allow vold_prepare_subdirs user_profile_data_file:dir { search getattr relabelfrom };
55allow vold_prepare_subdirs user_profile_root_file:dir { search getattr relabelfrom relabelto };
Alan Stokes53c76a22022-02-08 15:44:06 +0000[diff] [blame]56
57# Migrate legacy labels to apex_system_server_data_file (b/217581286)
58allow vold_prepare_subdirs {
59 apex_appsearch_data_file
60 apex_permission_data_file
61 apex_scheduling_data_file
Treehugger Robotbad95e02022-05-03 13:44:35 +0000[diff] [blame]62 apex_tethering_data_file
Alan Stokes53c76a22022-02-08 15:44:06 +0000[diff] [blame]63 apex_wifi_data_file
64}:dir relabelfrom;
65
Alan Stokesfc0cab82020-02-11 14:43:05 +0000[diff] [blame]66# /data/misc is unlabeled during early boot.
67allow vold_prepare_subdirs unlabeled:dir search;
Joel Galenson5d5ac9a2019-05-09 10:43:59 -0700[diff] [blame]68
69dontaudit vold_prepare_subdirs { proc unlabeled }:file r_file_perms;