| Paul Crowley | 5b962cf | 2017-10-13 14:54:32 -0700 | [diff] [blame] | 1 | domain_auto_trans(vold, vold_prepare_subdirs_exec, vold_prepare_subdirs) |
| Jin Qian | c012533 | 2017-10-19 14:41:37 -0700 | [diff] [blame] | 2 | |
| Alan Stokes | fc0cab8 | 2020-02-11 14:43:05 +0000 | [diff] [blame] | 3 | typeattribute vold_prepare_subdirs mlstrustedsubject; |
| 4 | |
| Paul Crowley | 5850a2a | 2017-10-25 13:03:24 -0700 | [diff] [blame] | 5 | allow vold_prepare_subdirs system_file:file execute_no_trans; |
| 6 | allow vold_prepare_subdirs shell_exec:file rx_file_perms; |
| 7 | allow vold_prepare_subdirs toolbox_exec:file rx_file_perms; |
| 8 | allow vold_prepare_subdirs devpts:chr_file rw_file_perms; |
| 9 | allow vold_prepare_subdirs vold:fd use; |
| 10 | allow vold_prepare_subdirs vold:fifo_file { read write }; |
| 11 | allow vold_prepare_subdirs file_contexts_file:file r_file_perms; |
| Benjamin Gordon | 342362a | 2018-09-06 16:19:40 -0600 | [diff] [blame] | 12 | allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override dac_read_search fowner }; |
| Paul Crowley | 5850a2a | 2017-10-25 13:03:24 -0700 | [diff] [blame] | 13 | allow vold_prepare_subdirs self:process setfscreate; |
| Jeff Vander Stoep | d25ccab | 2018-02-07 16:29:06 -0800 | [diff] [blame] | 14 | allow vold_prepare_subdirs { |
| Mohammad Samiul Islam | ef1698a | 2022-05-11 21:43:54 +0100 | [diff] [blame^] | 15 | sdk_sandbox_system_data_file |
| Jeff Vander Stoep | d25ccab | 2018-02-07 16:29:06 -0800 | [diff] [blame] | 16 | system_data_file |
| 17 | vendor_data_file |
| Joel Galenson | 254a872 | 2018-04-16 14:50:38 -0700 | [diff] [blame] | 18 | }:dir { open read write add_name remove_name rmdir relabelfrom }; |
| Paul Crowley | 8096639 | 2018-04-26 13:41:13 -0700 | [diff] [blame] | 19 | allow vold_prepare_subdirs { |
| Alan Stokes | fa10a14 | 2021-07-12 14:21:48 +0100 | [diff] [blame] | 20 | apex_data_file_type |
| Oli Lan | 79b4e1a | 2019-11-19 18:10:16 +0000 | [diff] [blame] | 21 | apex_module_data_file |
| Oli Lan | 91ce5b9 | 2019-12-02 18:29:48 +0000 | [diff] [blame] | 22 | apex_rollback_data_file |
| Annie Meng | 4c3d11c | 2019-01-15 21:20:13 +0000 | [diff] [blame] | 23 | backup_data_file |
| Tianjie | b729aa6 | 2021-10-05 22:13:20 -0700 | [diff] [blame] | 24 | checkin_data_file |
| Kevin Chyn | 91c2580 | 2018-11-15 15:28:07 -0800 | [diff] [blame] | 25 | face_vendor_data_file |
| Nick Kralevich | 83f25e2 | 2018-11-19 18:42:11 +0000 | [diff] [blame] | 26 | fingerprint_vendor_data_file |
| Kevin Chyn | 91c2580 | 2018-11-15 15:28:07 -0800 | [diff] [blame] | 27 | iris_vendor_data_file |
| Narayan Kamath | 2ad229c | 2019-01-14 15:02:12 +0000 | [diff] [blame] | 28 | rollback_data_file |
| Paul Crowley | 8096639 | 2018-04-26 13:41:13 -0700 | [diff] [blame] | 29 | storaged_data_file |
| Nikita Ioffe | e2da633 | 2022-02-21 17:55:59 +0000 | [diff] [blame] | 30 | sdk_sandbox_data_file |
| Mohammad Samiul Islam | ef1698a | 2022-05-11 21:43:54 +0100 | [diff] [blame^] | 31 | sdk_sandbox_system_data_file |
| Alan Stokes | fc0cab8 | 2020-02-11 14:43:05 +0000 | [diff] [blame] | 32 | system_data_file |
| Paul Crowley | 8096639 | 2018-04-26 13:41:13 -0700 | [diff] [blame] | 33 | vold_data_file |
| 34 | }:dir { create_dir_perms relabelto }; |
| 35 | allow vold_prepare_subdirs { |
| Alan Stokes | fa10a14 | 2021-07-12 14:21:48 +0100 | [diff] [blame] | 36 | apex_data_file_type |
| Orion Hodson | 8f75f76 | 2020-10-16 15:29:55 +0100 | [diff] [blame] | 37 | apex_art_staging_data_file |
| Oli Lan | 79b4e1a | 2019-11-19 18:10:16 +0000 | [diff] [blame] | 38 | apex_module_data_file |
| Oli Lan | 91ce5b9 | 2019-12-02 18:29:48 +0000 | [diff] [blame] | 39 | apex_rollback_data_file |
| Annie Meng | 4c3d11c | 2019-01-15 21:20:13 +0000 | [diff] [blame] | 40 | backup_data_file |
| Tianjie | b729aa6 | 2021-10-05 22:13:20 -0700 | [diff] [blame] | 41 | checkin_data_file |
| Kevin Chyn | 91c2580 | 2018-11-15 15:28:07 -0800 | [diff] [blame] | 42 | face_vendor_data_file |
| Nick Kralevich | 83f25e2 | 2018-11-19 18:42:11 +0000 | [diff] [blame] | 43 | fingerprint_vendor_data_file |
| Kevin Chyn | 91c2580 | 2018-11-15 15:28:07 -0800 | [diff] [blame] | 44 | iris_vendor_data_file |
| Narayan Kamath | 2ad229c | 2019-01-14 15:02:12 +0000 | [diff] [blame] | 45 | rollback_data_file |
| Paul Crowley | 8096639 | 2018-04-26 13:41:13 -0700 | [diff] [blame] | 46 | storaged_data_file |
| Nikita Ioffe | e2da633 | 2022-02-21 17:55:59 +0000 | [diff] [blame] | 47 | sdk_sandbox_data_file |
| Paul Crowley | 8096639 | 2018-04-26 13:41:13 -0700 | [diff] [blame] | 48 | system_data_file |
| 49 | vold_data_file |
| 50 | }:file { getattr unlink }; |
| Oli Lan | 79b4e1a | 2019-11-19 18:10:16 +0000 | [diff] [blame] | 51 | allow vold_prepare_subdirs apex_mnt_dir:dir { open read }; |
| Alan Stokes | fc0cab8 | 2020-02-11 14:43:05 +0000 | [diff] [blame] | 52 | allow vold_prepare_subdirs mnt_expand_file:dir search; |
| Alan Stokes | 7aa4041 | 2020-12-04 14:07:52 +0000 | [diff] [blame] | 53 | allow vold_prepare_subdirs user_profile_data_file:dir { search getattr relabelfrom }; |
| 54 | allow vold_prepare_subdirs user_profile_root_file:dir { search getattr relabelfrom relabelto }; |
| Alan Stokes | 53c76a2 | 2022-02-08 15:44:06 +0000 | [diff] [blame] | 55 | |
| 56 | # Migrate legacy labels to apex_system_server_data_file (b/217581286) |
| 57 | allow vold_prepare_subdirs { |
| 58 | apex_appsearch_data_file |
| 59 | apex_permission_data_file |
| 60 | apex_scheduling_data_file |
| Treehugger Robot | bad95e0 | 2022-05-03 13:44:35 +0000 | [diff] [blame] | 61 | apex_tethering_data_file |
| Alan Stokes | 53c76a2 | 2022-02-08 15:44:06 +0000 | [diff] [blame] | 62 | apex_wifi_data_file |
| 63 | }:dir relabelfrom; |
| 64 | |
| Alan Stokes | fc0cab8 | 2020-02-11 14:43:05 +0000 | [diff] [blame] | 65 | # /data/misc is unlabeled during early boot. |
| 66 | allow vold_prepare_subdirs unlabeled:dir search; |
| Joel Galenson | 5d5ac9a | 2019-05-09 10:43:59 -0700 | [diff] [blame] | 67 | |
| 68 | dontaudit vold_prepare_subdirs { proc unlabeled }:file r_file_perms; |