| ynwang | 9fa8823 | 2016-06-17 15:05:10 -0700 | [diff] [blame] | 1 | # storaged daemon |
| ynwang | e68d2d2 | 2016-07-01 12:18:54 -0700 | [diff] [blame] | 2 | type storaged, domain, mlstrustedsubject; |
| ynwang | 9fa8823 | 2016-06-17 15:05:10 -0700 | [diff] [blame] | 3 | type storaged_exec, exec_type, file_type; |
| 4 | |
| 5 | init_daemon_domain(storaged) |
| 6 | |
| ynwang | 9fa8823 | 2016-06-17 15:05:10 -0700 | [diff] [blame] | 7 | # Read access to pseudo filesystems |
| ynwang | 9fa8823 | 2016-06-17 15:05:10 -0700 | [diff] [blame] | 8 | r_dir_file(storaged, sysfs_type) |
| 9 | r_dir_file(storaged, proc_net) |
| ynwang | e68d2d2 | 2016-07-01 12:18:54 -0700 | [diff] [blame] | 10 | r_dir_file(storaged, domain) |
| ynwang | 9fa8823 | 2016-06-17 15:05:10 -0700 | [diff] [blame] | 11 | |
| Jin Qian | d345906 | 2017-01-11 16:20:49 -0800 | [diff] [blame] | 12 | # Read /proc/uid_io/stats |
| 13 | allow storaged proc_uid_io_stats:file r_file_perms; |
| 14 | |
| Jin Qian | 8ad57ef | 2017-01-20 20:29:13 -0800 | [diff] [blame^] | 15 | # Read /data/system/packages.list |
| 16 | allow storaged system_data_file:file r_file_perms; |
| 17 | |
| ynwang | e68d2d2 | 2016-07-01 12:18:54 -0700 | [diff] [blame] | 18 | allow storaged self:capability { setgid setuid sys_nice sys_ptrace }; |
| ynwang | 9fa8823 | 2016-06-17 15:05:10 -0700 | [diff] [blame] | 19 | |
| ynwang | e68d2d2 | 2016-07-01 12:18:54 -0700 | [diff] [blame] | 20 | userdebug_or_eng(` |
| 21 | # Read access to debugfs |
| 22 | allow storaged debugfs_mmc:dir search; |
| 23 | allow storaged debugfs_mmc:file r_file_perms; |
| 24 | ') |
| ynwang | 9fa8823 | 2016-06-17 15:05:10 -0700 | [diff] [blame] | 25 | |
| ynwang | e68d2d2 | 2016-07-01 12:18:54 -0700 | [diff] [blame] | 26 | # Binder permissions |
| 27 | allow storaged storaged_service:service_manager add; |
| Jin Qian | d345906 | 2017-01-11 16:20:49 -0800 | [diff] [blame] | 28 | |
| ynwang | e68d2d2 | 2016-07-01 12:18:54 -0700 | [diff] [blame] | 29 | binder_use(storaged) |
| 30 | binder_call(storaged, system_server) |
| 31 | |
| 32 | ### |
| 33 | ### neverallow |
| 34 | ### |
| 35 | neverallow storaged domain:process ptrace; |