| David Anderson | fe30369 | 2020-10-19 22:11:29 -0700 | [diff] [blame] | 1 | # snapuserd - Daemon for servicing dm-user requests for Virtual A/B snapshots. |
| David Anderson | 09bb944 | 2020-11-13 00:45:59 -0800 | [diff] [blame] | 2 | type snapuserd, domain; |
| 3 | type snapuserd_exec, exec_type, file_type, system_file_type; |
| David Anderson | fe30369 | 2020-10-19 22:11:29 -0700 | [diff] [blame] | 4 | |
| 5 | typeattribute snapuserd coredomain; |
| 6 | |
| 7 | init_daemon_domain(snapuserd) |
| 8 | |
| 9 | allow snapuserd kmsg_device:chr_file rw_file_perms; |
| 10 | |
| 11 | # Reading and writing to /dev/block/dm-* (device-mapper) nodes. |
| 12 | allow snapuserd block_device:dir r_dir_perms; |
| 13 | allow snapuserd dm_device:chr_file rw_file_perms; |
| 14 | allow snapuserd dm_device:blk_file rw_file_perms; |
| 15 | |
| 16 | # Reading and writing to dm-user control nodes. |
| David Anderson | 09bb944 | 2020-11-13 00:45:59 -0800 | [diff] [blame] | 17 | allow snapuserd dm_user_device:dir r_dir_perms; |
| David Anderson | fe30369 | 2020-10-19 22:11:29 -0700 | [diff] [blame] | 18 | allow snapuserd dm_user_device:chr_file rw_file_perms; |
| David Anderson | f4cba7e | 2020-12-02 21:15:08 -0800 | [diff] [blame^] | 19 | |
| 20 | # Reading and writing to /dev/socket/snapuserd. |
| 21 | allow snapuserd snapuserd_socket:unix_stream_socket { accept listen getattr read write }; |
| 22 | |
| 23 | # This arises due to first-stage init opening /dev/null without F_CLOEXEC |
| 24 | # (see SetStdioToDevNull in init). When we fork() and execveat() snapuserd |
| 25 | # again, the descriptor leaks into the new process. |
| 26 | allow snapuserd kernel:fd use; |