1 # remote storage process (runs as nobody) 2 type rmt, domain, domain_deprecated; 3 type rmt_exec, exec_type, file_type; 4 5 # Started by init 6 init_daemon_domain(rmt) 7 8 # Drop (user, group) to (nobody, nobody) 9 allow rmt self:capability { setuid setgid dac_override setpcap net_raw }; 10 11 # opens and reads /dev/block/mmcblk0 12 allow rmt root_block_device:blk_file r_file_perms; 13 14 # Allow reads/writes to modem related block devices 15 allow rmt modem_block_device:blk_file rw_file_perms; 16 allow rmt block_device:dir r_dir_perms; 17 allow rmt cgroup:dir { create add_name }; 18 allow rmt smem_log_device:chr_file rw_file_perms; 19 20 # Needed for ioprio_set(IOPRIO_WHO_PROCESS, 0, IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT); 21 allow rmt self:capability sys_admin; 22 23 allow rmt ssd_block_device:blk_file rw_file_perms; 24 25 allow rmt self:socket create_socket_perms; 26 27 # Wake lock access 28 wakelock_use(rmt) 29 30 # Allow access to /dev/uio0. 31 allow rmt uio_device:chr_file rw_file_perms; 32 33 allow rmt mmc_block_device:blk_file r_file_perms; 34
