David Anderson | fe30369 | 2020-10-19 22:11:29 -0700 | [diff] [blame] | 1 | # snapuserd - Daemon for servicing dm-user requests for Virtual A/B snapshots. |
David Anderson | 09bb944 | 2020-11-13 00:45:59 -0800 | [diff] [blame] | 2 | type snapuserd, domain; |
| 3 | type snapuserd_exec, exec_type, file_type, system_file_type; |
David Anderson | fe30369 | 2020-10-19 22:11:29 -0700 | [diff] [blame] | 4 | |
| 5 | typeattribute snapuserd coredomain; |
| 6 | |
| 7 | init_daemon_domain(snapuserd) |
| 8 | |
| 9 | allow snapuserd kmsg_device:chr_file rw_file_perms; |
| 10 | |
Akilesh Kailash | 5c5fd25 | 2022-01-05 04:21:44 +0000 | [diff] [blame] | 11 | allow snapuserd self:capability ipc_lock; |
| 12 | |
Akilesh Kailash | 8494fbe | 2021-07-22 08:23:45 +0000 | [diff] [blame] | 13 | # Allow snapuserd to reach block devices in /dev/block. |
| 14 | allow snapuserd block_device:dir search; |
| 15 | |
| 16 | # Read /sys/block to find all the DM directories like (/sys/block/dm-X). |
| 17 | allow snapuserd sysfs:dir { open read }; |
| 18 | |
| 19 | # Read /sys/block/dm-X/dm/name (which is a symlink to |
| 20 | # /sys/devices/virtual/block/dm-X/dm/name) to identify the mapping between |
| 21 | # dm-X and dynamic partitions. |
| 22 | allow snapuserd sysfs_dm:dir { open read search }; |
| 23 | allow snapuserd sysfs_dm:file r_file_perms; |
| 24 | |
David Anderson | fe30369 | 2020-10-19 22:11:29 -0700 | [diff] [blame] | 25 | # Reading and writing to /dev/block/dm-* (device-mapper) nodes. |
| 26 | allow snapuserd block_device:dir r_dir_perms; |
| 27 | allow snapuserd dm_device:chr_file rw_file_perms; |
| 28 | allow snapuserd dm_device:blk_file rw_file_perms; |
| 29 | |
| 30 | # Reading and writing to dm-user control nodes. |
David Anderson | 09bb944 | 2020-11-13 00:45:59 -0800 | [diff] [blame] | 31 | allow snapuserd dm_user_device:dir r_dir_perms; |
David Anderson | fe30369 | 2020-10-19 22:11:29 -0700 | [diff] [blame] | 32 | allow snapuserd dm_user_device:chr_file rw_file_perms; |
David Anderson | f4cba7e | 2020-12-02 21:15:08 -0800 | [diff] [blame] | 33 | |
David Anderson | bf5b6ce | 2021-07-26 15:03:11 -0700 | [diff] [blame] | 34 | # Reading and writing to /dev/socket/snapuserd and snapuserd_proxy. |
David Anderson | f4cba7e | 2020-12-02 21:15:08 -0800 | [diff] [blame] | 35 | allow snapuserd snapuserd_socket:unix_stream_socket { accept listen getattr read write }; |
David Anderson | bf5b6ce | 2021-07-26 15:03:11 -0700 | [diff] [blame] | 36 | allow snapuserd snapuserd_proxy_socket:sock_file write; |
David Anderson | f4cba7e | 2020-12-02 21:15:08 -0800 | [diff] [blame] | 37 | |
| 38 | # This arises due to first-stage init opening /dev/null without F_CLOEXEC |
| 39 | # (see SetStdioToDevNull in init). When we fork() and execveat() snapuserd |
| 40 | # again, the descriptor leaks into the new process. |
| 41 | allow snapuserd kernel:fd use; |
David Anderson | bf5b6ce | 2021-07-26 15:03:11 -0700 | [diff] [blame] | 42 | |
| 43 | # snapuserd.* properties |
| 44 | set_prop(snapuserd, snapuserd_prop) |
Akilesh Kailash | 8a9ec2a | 2021-11-09 08:42:54 +0000 | [diff] [blame] | 45 | get_prop(snapuserd, virtual_ab_prop) |
David Anderson | bf5b6ce | 2021-07-26 15:03:11 -0700 | [diff] [blame] | 46 | |
| 47 | # For inotify watching for /dev/socket/snapuserd_proxy to appear. |
David Anderson | 136b4ea | 2021-08-04 19:24:06 -0700 | [diff] [blame] | 48 | allow snapuserd tmpfs:dir { read watch }; |
David Anderson | bf5b6ce | 2021-07-26 15:03:11 -0700 | [diff] [blame] | 49 | |
| 50 | # Forbid anything other than snapuserd and init setting snapuserd properties. |
| 51 | neverallow { |
| 52 | domain |
| 53 | -snapuserd |
| 54 | -init |
| 55 | } snapuserd_prop:property_service set; |
Kelvin Zhang | aa3ac9f | 2022-09-06 02:10:26 +0000 | [diff] [blame^] | 56 | |
| 57 | allow snapuserd self:anon_inode create_file_perms; |