1 # Filesystem types 2 type labeledfs, fs_type; 3 type pipefs, fs_type; 4 type sockfs, fs_type; 5 type rootfs, fs_type; 6 type proc, fs_type; 7 # Security-sensitive proc nodes that should not be writable to most. 8 type proc_security, fs_type; 9 # proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers. 10 type usermodehelper, fs_type, sysfs_type; 11 type qtaguid_proc, fs_type, mlstrustedobject; 12 type proc_bluetooth_writable, fs_type; 13 type proc_cpuinfo, fs_type; 14 type proc_net, fs_type; 15 type proc_sysrq, fs_type; 16 type selinuxfs, fs_type; 17 type cgroup, fs_type, mlstrustedobject; 18 type sysfs, fs_type, sysfs_type, mlstrustedobject; 19 type sysfs_writable, fs_type, sysfs_type, mlstrustedobject; 20 type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject; 21 type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject; 22 type sysfs_wake_lock, fs_type, sysfs_type; 23 # /sys/devices/system/cpu 24 type sysfs_devices_system_cpu, fs_type, sysfs_type; 25 # /sys/module/lowmemorykiller 26 type sysfs_lowmemorykiller, fs_type, sysfs_type; 27 type inotify, fs_type, mlstrustedobject; 28 type devpts, fs_type, mlstrustedobject; 29 type tmpfs, fs_type; 30 type shm, fs_type; 31 type mqueue, fs_type; 32 type fuse, sdcard_type, fs_type, mlstrustedobject; 33 type vfat, sdcard_type, fs_type, mlstrustedobject; 34 typealias fuse alias sdcard_internal; 35 typealias vfat alias sdcard_external; 36 type debugfs, fs_type, mlstrustedobject; 37 type pstorefs, fs_type; 38 type functionfs, fs_type; 39 type oemfs, fs_type, contextmount_type; 40 type usbfs, fs_type; 41 42 # File types 43 type unlabeled, file_type; 44 # Default type for anything under /system. 45 type system_file, file_type; 46 # Default type for anything under /data. 47 type system_data_file, file_type, data_file_type; 48 # /data/.layout_version or other installd-created files that 49 # are created in a system_data_file directory. 50 type install_data_file, file_type, data_file_type; 51 # /data/drm - DRM plugin data 52 type drm_data_file, file_type, data_file_type; 53 # /data/anr - ANR traces 54 type anr_data_file, file_type, data_file_type, mlstrustedobject; 55 # /data/tombstones - core dumps 56 type tombstone_data_file, file_type, data_file_type; 57 # /data/app - user-installed apps 58 type apk_data_file, file_type, data_file_type; 59 type apk_tmp_file, file_type, data_file_type, mlstrustedobject; 60 # /data/app-private - forward-locked apps 61 type apk_private_data_file, file_type, data_file_type; 62 type apk_private_tmp_file, file_type, data_file_type, mlstrustedobject; 63 # /data/dalvik-cache 64 type dalvikcache_data_file, file_type, data_file_type; 65 # /data/dalvik-cache/profiles 66 type dalvikcache_profiles_data_file, file_type, data_file_type; 67 # /data/resource-cache 68 type resourcecache_data_file, file_type, data_file_type; 69 # /data/local - writable by shell 70 type shell_data_file, file_type, data_file_type; 71 # /data/gps 72 type gps_data_file, file_type, data_file_type; 73 # /data/property 74 type property_data_file, file_type, data_file_type; 75 76 # /data/misc subdirectories 77 type adb_keys_file, file_type, data_file_type; 78 type audio_data_file, file_type, data_file_type; 79 type bluetooth_data_file, file_type, data_file_type; 80 type camera_data_file, file_type, data_file_type; 81 type keychain_data_file, file_type, data_file_type; 82 type keystore_data_file, file_type, data_file_type; 83 type media_data_file, file_type, data_file_type; 84 type media_rw_data_file, file_type, data_file_type; 85 type misc_user_data_file, file_type, data_file_type; 86 type net_data_file, file_type, data_file_type; 87 type nfc_data_file, file_type, data_file_type; 88 type radio_data_file, file_type, data_file_type; 89 type shared_relro_file, file_type, data_file_type; 90 type systemkeys_data_file, file_type, data_file_type; 91 type vpn_data_file, file_type, data_file_type; 92 type wifi_data_file, file_type, data_file_type; 93 type zoneinfo_data_file, file_type, data_file_type; 94 95 # Compatibility with type names used in vanilla Android 4.3 and 4.4. 96 typealias audio_data_file alias audio_firmware_file; 97 # /data/data subdirectories - app sandboxes 98 type app_data_file, file_type, data_file_type; 99 # /data/data subdirectory for system UID apps. 100 type system_app_data_file, file_type, data_file_type; 101 # Compatibility with type name used in Android 4.3 and 4.4. 102 typealias app_data_file alias platform_app_data_file; 103 typealias app_data_file alias download_file; 104 # Default type for anything under /cache 105 type cache_file, file_type, mlstrustedobject; 106 # Type for /cache/.*\.{data|restore} and default 107 # type for anything under /cache/backup 108 type cache_backup_file, file_type, mlstrustedobject; 109 # Default type for anything under /efs 110 type efs_file, file_type; 111 # Type for wallpaper file. 112 type wallpaper_file, file_type, mlstrustedobject; 113 # /mnt/asec 114 type asec_apk_file, file_type, data_file_type; 115 # Elements of asec files (/mnt/asec) that are world readable 116 type asec_public_file, file_type, data_file_type; 117 # /data/app-asec 118 type asec_image_file, file_type, data_file_type; 119 # /data/backup and /data/secure/backup 120 type backup_data_file, file_type, data_file_type, mlstrustedobject; 121 # For /data/security 122 type security_file, file_type; 123 # All devices have bluetooth efs files. But they 124 # vary per device, so this type is used in per 125 # device policy 126 type bluetooth_efs_file, file_type; 127 128 # Socket types 129 type adbd_socket, file_type; 130 type bluetooth_socket, file_type; 131 type dnsproxyd_socket, file_type, mlstrustedobject; 132 type dumpstate_socket, file_type; 133 type fwmarkd_socket, file_type, mlstrustedobject; 134 type gps_socket, file_type; 135 type installd_socket, file_type; 136 type lmkd_socket, file_type; 137 type logd_debug, file_type; 138 type logd_socket, file_type; 139 type logdr_socket, file_type; 140 type logdw_socket, file_type; 141 type mdns_socket, file_type; 142 type mdnsd_socket, file_type; 143 type mtpd_socket, file_type; 144 type netd_socket, file_type; 145 type property_socket, file_type; 146 type racoon_socket, file_type; 147 type rild_socket, file_type; 148 type rild_debug_socket, file_type; 149 type system_wpa_socket, file_type; 150 type system_ndebug_socket, file_type; 151 type vold_socket, file_type; 152 type wpa_socket, file_type; 153 type zygote_socket, file_type; 154 155 # UART (for GPS) control proc file 156 type gps_control, file_type; 157 158 # Allow files to be created in their appropriate filesystems. 159 allow fs_type self:filesystem associate; 160 allow sysfs_type sysfs:filesystem associate; 161 allow file_type labeledfs:filesystem associate; 162 allow file_type tmpfs:filesystem associate; 163 allow file_type rootfs:filesystem associate; 164 allow dev_type tmpfs:filesystem associate; 165 166 # It's a bug to assign the file_type attribute and fs_type attribute 167 # to any type. Do not allow it. 168 # 169 # For example, the following is a bug: 170 # type apk_data_file, file_type, data_file_type, fs_type; 171 # Should be: 172 # type apk_data_file, file_type, data_file_type; 173 neverallow fs_type file_type:filesystem associate; 174
