1 # Filesystem types 2 type labeledfs, fs_type; 3 type pipefs, fs_type; 4 type sockfs, fs_type; 5 type rootfs, fs_type; 6 type proc, fs_type; 7 # Security-sensitive proc nodes that should not be writable to most. 8 type proc_security, fs_type; 9 type proc_drop_caches, fs_type; 10 type proc_overcommit_memory, fs_type; 11 # proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers. 12 type usermodehelper, fs_type; 13 type sysfs_usermodehelper, fs_type, sysfs_type; 14 type qtaguid_proc, fs_type, mlstrustedobject; 15 type proc_bluetooth_writable, fs_type; 16 type proc_cpuinfo, fs_type; 17 type proc_interrupts, fs_type; 18 type proc_iomem, fs_type; 19 type proc_meminfo, fs_type; 20 type proc_misc, fs_type; 21 type proc_modules, fs_type; 22 type proc_net, fs_type; 23 type proc_perf, fs_type; 24 type proc_stat, fs_type; 25 type proc_sysrq, fs_type; 26 type proc_timer, fs_type; 27 type proc_tty_drivers, fs_type; 28 type proc_uid_cputime_showstat, fs_type; 29 type proc_uid_cputime_removeuid, fs_type; 30 type proc_uid_io_stats, fs_type; 31 type proc_uid_procstat_set, fs_type; 32 type proc_uid_time_in_state, fs_type; 33 type proc_zoneinfo, fs_type; 34 type selinuxfs, fs_type, mlstrustedobject; 35 type cgroup, fs_type, mlstrustedobject; 36 type sysfs, fs_type, sysfs_type, mlstrustedobject; 37 type sysfs_uio, sysfs_type, fs_type; 38 type sysfs_batteryinfo, fs_type, sysfs_type; 39 type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject; 40 type sysfs_leds, fs_type, sysfs_type; 41 type sysfs_hwrandom, fs_type, sysfs_type; 42 type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject; 43 type sysfs_wake_lock, fs_type, sysfs_type; 44 type sysfs_mac_address, fs_type, sysfs_type; 45 type sysfs_usb, sysfs_type, file_type, mlstrustedobject; 46 type sysfs_fs_ext4_features, sysfs_type, fs_type; 47 type configfs, fs_type; 48 # /sys/devices/system/cpu 49 type sysfs_devices_system_cpu, fs_type, sysfs_type; 50 # /sys/module/lowmemorykiller 51 type sysfs_lowmemorykiller, fs_type, sysfs_type; 52 # /sys/module/wlan/parameters/fwpath 53 type sysfs_wlan_fwpath, fs_type, sysfs_type; 54 type sysfs_vibrator, fs_type, sysfs_type; 55 56 type sysfs_thermal, sysfs_type, fs_type; 57 58 type sysfs_zram, fs_type, sysfs_type; 59 type sysfs_zram_uevent, fs_type, sysfs_type; 60 type inotify, fs_type, mlstrustedobject; 61 type devpts, fs_type, mlstrustedobject; 62 type tmpfs, fs_type; 63 type shm, fs_type; 64 type mqueue, fs_type; 65 type fuse, sdcard_type, fs_type, mlstrustedobject; 66 type sdcardfs, sdcard_type, fs_type, mlstrustedobject; 67 type vfat, sdcard_type, fs_type, mlstrustedobject; 68 type debugfs, fs_type, debugfs_type; 69 type debugfs_mmc, fs_type, debugfs_type; 70 type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject; 71 type debugfs_tracing, fs_type, debugfs_type; 72 type debugfs_tracing_debug, fs_type, debugfs_type; 73 type debugfs_tracing_instances, fs_type, debugfs_type; 74 type debugfs_wifi_tracing, fs_type, debugfs_type; 75 76 type pstorefs, fs_type; 77 type functionfs, fs_type, mlstrustedobject; 78 type oemfs, fs_type, contextmount_type; 79 type usbfs, fs_type; 80 type binfmt_miscfs, fs_type; 81 type app_fusefs, fs_type, contextmount_type; 82 83 # File types 84 type unlabeled, file_type; 85 86 # Default type for anything under /system. 87 type system_file, file_type; 88 89 # Default type for directories search for 90 # HAL implementations 91 type vendor_hal_file, vendor_file_type, file_type; 92 # Default type for under /vendor or /system/vendor 93 type vendor_file, vendor_file_type, file_type; 94 # Default type for everything in /vendor/app 95 type vendor_app_file, vendor_file_type, file_type; 96 # Default type for everything under /vendor/etc/ 97 type vendor_configs_file, vendor_file_type, file_type; 98 # Default type for all *same process* HALs. 99 # e.g. libEGL_xxx.so, android.hardware.graphics.mapper (a] 2.0-impl.so 100 type same_process_hal_file, vendor_file_type, file_type; 101 # Default type for vndk-sp libs. /vendor/lib/vndk-sp 102 type vndk_sp_file, vendor_file_type, file_type; 103 # Default type for everything in /vendor/framework 104 type vendor_framework_file, vendor_file_type, file_type; 105 # Default type for everything in /vendor/overlay 106 type vendor_overlay_file, vendor_file_type, file_type; 107 108 # Speedup access for trusted applications to the runtime event tags 109 type runtime_event_log_tags_file, file_type; 110 # Type for /system/bin/logcat. 111 type logcat_exec, exec_type, file_type; 112 # /cores for coredumps on userdebug / eng builds 113 type coredump_file, file_type; 114 # Default type for anything under /data. 115 type system_data_file, file_type, data_file_type, core_data_file_type; 116 # Unencrypted data 117 type unencrypted_data_file, file_type, data_file_type, core_data_file_type; 118 # /data/.layout_version or other installd-created files that 119 # are created in a system_data_file directory. 120 type install_data_file, file_type, data_file_type, core_data_file_type; 121 # /data/drm - DRM plugin data 122 type drm_data_file, file_type, data_file_type, core_data_file_type; 123 # /data/adb - adb debugging files 124 type adb_data_file, file_type, data_file_type, core_data_file_type; 125 # /data/anr - ANR traces 126 type anr_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 127 # /data/tombstones - core dumps 128 type tombstone_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 129 # /data/app - user-installed apps 130 type apk_data_file, file_type, data_file_type, core_data_file_type; 131 type apk_tmp_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 132 # /data/app-private - forward-locked apps 133 type apk_private_data_file, file_type, data_file_type, core_data_file_type; 134 type apk_private_tmp_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 135 # /data/dalvik-cache 136 type dalvikcache_data_file, file_type, data_file_type, core_data_file_type; 137 # /data/ota 138 type ota_data_file, file_type, data_file_type, core_data_file_type; 139 # /data/ota_package 140 type ota_package_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 141 # /data/misc/profiles 142 type user_profile_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 143 # /data/misc/profman 144 type profman_dump_data_file, file_type, data_file_type, core_data_file_type; 145 # /data/resource-cache 146 type resourcecache_data_file, file_type, data_file_type, core_data_file_type; 147 # /data/local - writable by shell 148 type shell_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 149 # /data/property 150 type property_data_file, file_type, data_file_type, core_data_file_type; 151 # /data/bootchart 152 type bootchart_data_file, file_type, data_file_type, core_data_file_type; 153 # /data/system/heapdump 154 type heapdump_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 155 # /data/nativetest 156 type nativetest_data_file, file_type, data_file_type, core_data_file_type; 157 # /data/system_de/0/ringtones 158 type ringtone_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 159 # /data/preloads 160 type preloads_data_file, file_type, data_file_type, core_data_file_type; 161 # /data/preloads/media 162 type preloads_media_file, file_type, data_file_type, core_data_file_type; 163 # /data/misc/dhcp and /data/misc/dhcp-6.8.2 164 type dhcp_data_file, file_type, data_file_type, core_data_file_type; 165 166 # Mount locations managed by vold 167 type mnt_media_rw_file, file_type; 168 type mnt_user_file, file_type; 169 type mnt_expand_file, file_type; 170 type storage_file, file_type; 171 172 # Label for storage dirs which are just mount stubs 173 type mnt_media_rw_stub_file, file_type; 174 type storage_stub_file, file_type; 175 176 # /postinstall: Mount point used by update_engine to run postinstall. 177 type postinstall_mnt_dir, file_type; 178 # Files inside the /postinstall mountpoint are all labeled as postinstall_file. 179 type postinstall_file, file_type; 180 181 # /data/misc subdirectories 182 type adb_keys_file, file_type, data_file_type, core_data_file_type; 183 type audio_data_file, file_type, data_file_type, core_data_file_type; 184 type audiohal_data_file, file_type, data_file_type, core_data_file_type; 185 type audioserver_data_file, file_type, data_file_type, core_data_file_type; 186 type bluetooth_data_file, file_type, data_file_type, core_data_file_type; 187 type bluetooth_logs_data_file, file_type, data_file_type, core_data_file_type; 188 type bootstat_data_file, file_type, data_file_type, core_data_file_type; 189 type boottrace_data_file, file_type, data_file_type, core_data_file_type; 190 type camera_data_file, file_type, data_file_type, core_data_file_type; 191 type gatekeeper_data_file, file_type, data_file_type, core_data_file_type; 192 type incident_data_file, file_type, data_file_type, core_data_file_type; 193 type keychain_data_file, file_type, data_file_type, core_data_file_type; 194 type keystore_data_file, file_type, data_file_type, core_data_file_type; 195 type media_data_file, file_type, data_file_type, core_data_file_type; 196 type media_rw_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 197 type misc_user_data_file, file_type, data_file_type, core_data_file_type; 198 type net_data_file, file_type, data_file_type, core_data_file_type; 199 type nfc_data_file, file_type, data_file_type, core_data_file_type; 200 type radio_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 201 type reboot_data_file, file_type, data_file_type, core_data_file_type; 202 type recovery_data_file, file_type, data_file_type, core_data_file_type; 203 type shared_relro_file, file_type, data_file_type, core_data_file_type; 204 type systemkeys_data_file, file_type, data_file_type, core_data_file_type; 205 type textclassifier_data_file, file_type, data_file_type, core_data_file_type; 206 type vpn_data_file, file_type, data_file_type, core_data_file_type; 207 type wifi_data_file, file_type, data_file_type, core_data_file_type; 208 type zoneinfo_data_file, file_type, data_file_type, core_data_file_type; 209 type vold_data_file, file_type, data_file_type, core_data_file_type; 210 type perfprofd_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 211 type tee_data_file, file_type, data_file_type; 212 type update_engine_data_file, file_type, data_file_type, core_data_file_type; 213 # /data/misc/trace for method traces on userdebug / eng builds 214 type method_trace_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 215 216 # /data/data subdirectories - app sandboxes 217 type app_data_file, file_type, data_file_type, core_data_file_type; 218 # /data/data subdirectory for system UID apps. 219 type system_app_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 220 # Compatibility with type name used in Android 4.3 and 4.4. 221 # Default type for anything under /cache 222 type cache_file, file_type, data_file_type, mlstrustedobject; 223 # Type for /cache/backup_stage/* (fd interchange with apps) 224 type cache_backup_file, file_type, data_file_type, mlstrustedobject; 225 # type for anything under /cache/backup (local transport storage) 226 type cache_private_backup_file, file_type, data_file_type; 227 # Type for anything under /cache/recovery 228 type cache_recovery_file, file_type, data_file_type, mlstrustedobject; 229 # Default type for anything under /efs 230 type efs_file, file_type; 231 # Type for wallpaper file. 232 type wallpaper_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 233 # Type for shortcut manager icon file. 234 type shortcut_manager_icons, file_type, data_file_type, core_data_file_type, mlstrustedobject; 235 # Type for user icon file. 236 type icon_file, file_type, data_file_type, core_data_file_type; 237 # /mnt/asec 238 type asec_apk_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 239 # Elements of asec files (/mnt/asec) that are world readable 240 type asec_public_file, file_type, data_file_type, core_data_file_type; 241 # /data/app-asec 242 type asec_image_file, file_type, data_file_type, core_data_file_type; 243 # /data/backup and /data/secure/backup 244 type backup_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 245 # All devices have bluetooth efs files. But they 246 # vary per device, so this type is used in per 247 # device policy 248 type bluetooth_efs_file, file_type; 249 # Type for fingerprint template file 250 type fingerprintd_data_file, file_type, data_file_type, core_data_file_type; 251 # Type for appfuse file. 252 type app_fuse_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 253 254 # Socket types 255 type adbd_socket, file_type, coredomain_socket; 256 type bluetooth_socket, file_type, data_file_type, coredomain_socket; 257 type dnsproxyd_socket, file_type, coredomain_socket, mlstrustedobject; 258 type dumpstate_socket, file_type, coredomain_socket; 259 type fwmarkd_socket, file_type, coredomain_socket, mlstrustedobject; 260 type lmkd_socket, file_type, coredomain_socket; 261 type logd_socket, file_type, coredomain_socket, mlstrustedobject; 262 type logdr_socket, file_type, coredomain_socket, mlstrustedobject; 263 type logdw_socket, file_type, coredomain_socket, mlstrustedobject; 264 type mdns_socket, file_type, coredomain_socket; 265 type mdnsd_socket, file_type, coredomain_socket, mlstrustedobject; 266 type misc_logd_file, coredomain_socket, file_type, data_file_type; 267 type mtpd_socket, file_type, coredomain_socket; 268 type netd_socket, file_type, coredomain_socket; 269 type property_socket, file_type, coredomain_socket, mlstrustedobject; 270 type racoon_socket, file_type, coredomain_socket; 271 type rild_socket, file_type; 272 type rild_debug_socket, file_type; 273 type system_wpa_socket, file_type, data_file_type, coredomain_socket; 274 type system_ndebug_socket, file_type, data_file_type, coredomain_socket, mlstrustedobject; 275 type tombstoned_crash_socket, file_type, coredomain_socket, mlstrustedobject; 276 type tombstoned_java_trace_socket, file_type, mlstrustedobject; 277 type tombstoned_intercept_socket, file_type, coredomain_socket; 278 type uncrypt_socket, file_type, coredomain_socket; 279 type vold_socket, file_type, coredomain_socket; 280 type webview_zygote_socket, file_type, coredomain_socket; 281 type wpa_socket, file_type, data_file_type; 282 type zygote_socket, file_type, coredomain_socket; 283 # UART (for GPS) control proc file 284 type gps_control, file_type; 285 286 # PDX endpoint types 287 type pdx_display_dir, pdx_endpoint_dir_type, file_type; 288 type pdx_performance_dir, pdx_endpoint_dir_type, file_type; 289 type pdx_bufferhub_dir, pdx_endpoint_dir_type, file_type; 290 291 pdx_service_socket_types(display_client, pdx_display_dir) 292 pdx_service_socket_types(display_manager, pdx_display_dir) 293 pdx_service_socket_types(display_screenshot, pdx_display_dir) 294 pdx_service_socket_types(display_vsync, pdx_display_dir) 295 pdx_service_socket_types(performance_client, pdx_performance_dir) 296 pdx_service_socket_types(bufferhub_client, pdx_bufferhub_dir) 297 298 # file_contexts files 299 type file_contexts_file, file_type; 300 301 # mac_permissions file 302 type mac_perms_file, file_type; 303 304 # property_contexts file 305 type property_contexts_file, file_type; 306 307 # seapp_contexts file 308 type seapp_contexts_file, file_type; 309 310 # sepolicy files binary and others 311 type sepolicy_file, file_type; 312 313 # service_contexts file 314 type service_contexts_file, file_type; 315 316 # nonplat service_contexts file (only accessible on non full-treble devices) 317 type nonplat_service_contexts_file, file_type; 318 319 # hwservice_contexts file 320 type hwservice_contexts_file, file_type; 321 322 # vndservice_contexts file 323 type vndservice_contexts_file, file_type; 324 325 # Allow files to be created in their appropriate filesystems. 326 allow fs_type self:filesystem associate; 327 allow cgroup tmpfs:filesystem associate; 328 allow sysfs_type sysfs:filesystem associate; 329 allow debugfs_type { debugfs debugfs_tracing }:filesystem associate; 330 allow file_type labeledfs:filesystem associate; 331 allow file_type tmpfs:filesystem associate; 332 allow file_type rootfs:filesystem associate; 333 allow dev_type tmpfs:filesystem associate; 334 allow app_fuse_file app_fusefs:filesystem associate; 335 allow postinstall_file self:filesystem associate; 336 337 # asanwrapper (run a sanitized app_process, to be used with wrap properties) 338 with_asan(`type asanwrapper_exec, exec_type, file_type;') 339 340 # It's a bug to assign the file_type attribute and fs_type attribute 341 # to any type. Do not allow it. 342 # 343 # For example, the following is a bug: 344 # type apk_data_file, file_type, data_file_type, fs_type; 345 # Should be: 346 # type apk_data_file, file_type, data_file_type; 347 neverallow fs_type file_type:filesystem associate; 348