1 # remote storage process (runs as nobody) 2 type rmt, domain; 3 type rmt_exec, exec_type, file_type; 4 5 # Started by init 6 init_daemon_domain(rmt) 7 8 # Drop (user, group) to (nobody, nobody) 9 allow rmt self:capability { setuid setgid }; 10 11 # opens and reads /dev/block/mmcblk0 12 allow rmt root_block_device:blk_file r_file_perms; 13 allow rmt root_block_device:dir r_dir_perms; 14 15 # Allow shared memory logging access 16 allow rmt shared_log_device:chr_file rw_file_perms; 17 18 allow rmt self:socket create_socket_perms; 19 allow rmt cgroup:dir { create add_name }; 20 21 # Wake lock access 22 wakelock_use(rmt) 23 24 # Access property service to set ctl.rmt_storage 25 unix_socket_connect(rmt, property, init) 26 allow rmt ctl_rmt_prop:property_service set; 27
