blob: ad7e6bb39fdb87a4fa7991774fe6819da871c0b8 [file] [log] [blame]
Paul Crowley5b962cf2017-10-13 14:54:32 -07001domain_auto_trans(vold, vold_prepare_subdirs_exec, vold_prepare_subdirs)
Jin Qianc0125332017-10-19 14:41:37 -07002
Alan Stokesfc0cab82020-02-11 14:43:05 +00003typeattribute vold_prepare_subdirs mlstrustedsubject;
4
Paul Crowley5850a2a2017-10-25 13:03:24 -07005allow vold_prepare_subdirs system_file:file execute_no_trans;
6allow vold_prepare_subdirs shell_exec:file rx_file_perms;
7allow vold_prepare_subdirs toolbox_exec:file rx_file_perms;
8allow vold_prepare_subdirs devpts:chr_file rw_file_perms;
9allow vold_prepare_subdirs vold:fd use;
10allow vold_prepare_subdirs vold:fifo_file { read write };
11allow vold_prepare_subdirs file_contexts_file:file r_file_perms;
Benjamin Gordon342362a2018-09-06 16:19:40 -060012allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override dac_read_search fowner };
Paul Crowley5850a2a2017-10-25 13:03:24 -070013allow vold_prepare_subdirs self:process setfscreate;
Jeff Vander Stoepd25ccab2018-02-07 16:29:06 -080014allow vold_prepare_subdirs {
15 system_data_file
16 vendor_data_file
Joel Galenson254a8722018-04-16 14:50:38 -070017}:dir { open read write add_name remove_name rmdir relabelfrom };
Paul Crowley80966392018-04-26 13:41:13 -070018allow vold_prepare_subdirs {
Alan Stokesfa10a142021-07-12 14:21:48 +010019 apex_data_file_type
Oli Lan79b4e1a2019-11-19 18:10:16 +000020 apex_module_data_file
Oli Lan91ce5b92019-12-02 18:29:48 +000021 apex_rollback_data_file
Annie Meng4c3d11c2019-01-15 21:20:13 +000022 backup_data_file
Kevin Chyn91c25802018-11-15 15:28:07 -080023 face_vendor_data_file
Nick Kralevich83f25e22018-11-19 18:42:11 +000024 fingerprint_vendor_data_file
Kevin Chyn91c25802018-11-15 15:28:07 -080025 iris_vendor_data_file
Narayan Kamath2ad229c2019-01-14 15:02:12 +000026 rollback_data_file
Paul Crowley80966392018-04-26 13:41:13 -070027 storaged_data_file
Alan Stokesfc0cab82020-02-11 14:43:05 +000028 system_data_file
Paul Crowley80966392018-04-26 13:41:13 -070029 vold_data_file
30}:dir { create_dir_perms relabelto };
31allow vold_prepare_subdirs {
Alan Stokesfa10a142021-07-12 14:21:48 +010032 apex_data_file_type
Orion Hodson8f75f762020-10-16 15:29:55 +010033 apex_art_staging_data_file
Oli Lan79b4e1a2019-11-19 18:10:16 +000034 apex_module_data_file
Oli Lan91ce5b92019-12-02 18:29:48 +000035 apex_rollback_data_file
Annie Meng4c3d11c2019-01-15 21:20:13 +000036 backup_data_file
Kevin Chyn91c25802018-11-15 15:28:07 -080037 face_vendor_data_file
Nick Kralevich83f25e22018-11-19 18:42:11 +000038 fingerprint_vendor_data_file
Kevin Chyn91c25802018-11-15 15:28:07 -080039 iris_vendor_data_file
Narayan Kamath2ad229c2019-01-14 15:02:12 +000040 rollback_data_file
Paul Crowley80966392018-04-26 13:41:13 -070041 storaged_data_file
42 system_data_file
43 vold_data_file
44}:file { getattr unlink };
Oli Lan79b4e1a2019-11-19 18:10:16 +000045allow vold_prepare_subdirs apex_mnt_dir:dir { open read };
Alan Stokesfc0cab82020-02-11 14:43:05 +000046allow vold_prepare_subdirs mnt_expand_file:dir search;
Alan Stokes7aa40412020-12-04 14:07:52 +000047allow vold_prepare_subdirs user_profile_data_file:dir { search getattr relabelfrom };
48allow vold_prepare_subdirs user_profile_root_file:dir { search getattr relabelfrom relabelto };
Alan Stokesfc0cab82020-02-11 14:43:05 +000049# /data/misc is unlabeled during early boot.
50allow vold_prepare_subdirs unlabeled:dir search;
Joel Galenson5d5ac9a2019-05-09 10:43:59 -070051
52dontaudit vold_prepare_subdirs { proc unlabeled }:file r_file_perms;