1 # volume manager 2 type vold, domain; 3 type vold_exec, exec_type, file_type; 4 5 # Read already opened /cache files. 6 allow vold cache_file:dir r_dir_perms; 7 allow vold cache_file:file { getattr read }; 8 allow vold cache_file:lnk_file r_file_perms; 9 10 # Read access to pseudo filesystems. 11 r_dir_file(vold, proc) 12 r_dir_file(vold, proc_net) 13 r_dir_file(vold, sysfs_type) 14 # XXX Label sysfs files with a specific type? 15 allow vold sysfs:file w_file_perms; 16 allow vold sysfs_usb:file w_file_perms; 17 allow vold sysfs_zram_uevent:file w_file_perms; 18 19 r_dir_file(vold, rootfs) 20 allow vold proc_meminfo:file r_file_perms; 21 22 #Get file contexts 23 allow vold file_contexts_file:file r_file_perms; 24 25 # Allow us to jump into execution domains of above tools 26 allow vold self:process setexec; 27 28 # For sgdisk launched through popen() 29 allow vold shell_exec:file rx_file_perms; 30 31 # For formatting adoptable storage devices 32 allow vold e2fs_exec:file rx_file_perms; 33 34 typeattribute vold mlstrustedsubject; 35 allow vold self:process setfscreate; 36 allow vold system_file:file x_file_perms; 37 not_full_treble(`allow vold vendor_file:file x_file_perms;') 38 allow vold block_device:dir create_dir_perms; 39 allow vold device:dir write; 40 allow vold devpts:chr_file rw_file_perms; 41 allow vold rootfs:dir mounton; 42 allow vold sdcard_type:dir mounton; # TODO: deprecated in M 43 allow vold sdcard_type:filesystem { mount remount unmount }; # TODO: deprecated in M 44 allow vold sdcard_type:dir create_dir_perms; # TODO: deprecated in M 45 allow vold sdcard_type:file create_file_perms; # TODO: deprecated in M 46 47 # Manage locations where storage is mounted 48 allow vold { mnt_media_rw_file storage_file sdcard_type }:dir create_dir_perms; 49 allow vold { mnt_media_rw_file storage_file sdcard_type }:file create_file_perms; 50 51 # Access to storage that backs emulated FUSE daemons for migration optimization 52 allow vold media_rw_data_file:dir create_dir_perms; 53 allow vold media_rw_data_file:file create_file_perms; 54 55 # Allow mounting of storage devices 56 allow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr }; 57 58 # Manage per-user primary symlinks 59 allow vold mnt_user_file:dir create_dir_perms; 60 allow vold mnt_user_file:lnk_file create_file_perms; 61 62 # Allow to create and mount expanded storage 63 allow vold mnt_expand_file:dir { create_dir_perms mounton }; 64 allow vold apk_data_file:dir { create getattr setattr }; 65 allow vold shell_data_file:dir { create getattr setattr }; 66 67 allow vold tmpfs:filesystem { mount unmount }; 68 allow vold tmpfs:dir create_dir_perms; 69 allow vold tmpfs:dir mounton; 70 allow vold self:capability { net_admin dac_override mknod sys_admin chown fowner fsetid }; 71 allow vold self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; 72 allow vold app_data_file:dir search; 73 allow vold app_data_file:file rw_file_perms; 74 allow vold loop_control_device:chr_file rw_file_perms; 75 allow vold loop_device:blk_file { create setattr unlink rw_file_perms }; 76 allow vold vold_device:blk_file { create setattr unlink rw_file_perms }; 77 allow vold dm_device:chr_file rw_file_perms; 78 allow vold dm_device:blk_file rw_file_perms; 79 # For vold Process::killProcessesWithOpenFiles function. 80 allow vold domain:dir r_dir_perms; 81 allow vold domain:{ file lnk_file } r_file_perms; 82 allow vold domain:process { signal sigkill }; 83 allow vold self:capability { sys_ptrace kill }; 84 85 # XXX Label sysfs files with a specific type? 86 allow vold sysfs:file rw_file_perms; 87 88 allow vold kmsg_device:chr_file rw_file_perms; 89 90 # Run fsck in the fsck domain. 91 allow vold fsck_exec:file { r_file_perms execute }; 92 93 # Log fsck results 94 allow vold fscklogs:dir rw_dir_perms; 95 allow vold fscklogs:file create_file_perms; 96 97 # 98 # Rules to support encrypted fs support. 99 # 100 101 # Unmount and mount the fs. 102 allow vold labeledfs:filesystem { mount unmount }; 103 104 # Access /efs/userdata_footer. 105 # XXX Split into a separate type? 106 allow vold efs_file:file rw_file_perms; 107 108 # Create and mount on /data/tmp_mnt and management of expansion mounts 109 allow vold system_data_file:dir { create rw_dir_perms mounton setattr rmdir }; 110 111 # Set scheduling policy of kernel processes 112 allow vold kernel:process setsched; 113 114 # Property Service 115 set_prop(vold, vold_prop) 116 set_prop(vold, powerctl_prop) 117 set_prop(vold, ctl_fuse_prop) 118 set_prop(vold, restorecon_prop) 119 120 # ASEC 121 allow vold asec_image_file:file create_file_perms; 122 allow vold asec_image_file:dir rw_dir_perms; 123 allow vold asec_apk_file:dir { create_dir_perms mounton relabelfrom relabelto }; 124 allow vold asec_public_file:dir { relabelto setattr }; 125 allow vold asec_apk_file:file { r_file_perms setattr relabelfrom relabelto }; 126 allow vold asec_public_file:file { relabelto setattr }; 127 # restorecon files in asec containers created on 4.2 or earlier. 128 allow vold unlabeled:dir { r_dir_perms setattr relabelfrom }; 129 allow vold unlabeled:file { r_file_perms setattr relabelfrom }; 130 131 # Handle wake locks (used for device encryption) 132 wakelock_use(vold) 133 134 # talk to batteryservice 135 binder_use(vold) 136 binder_call(vold, healthd) 137 138 # talk to keymaster 139 hal_client_domain(vold, hal_keymaster) 140 141 # Access userdata block device. 142 allow vold userdata_block_device:blk_file rw_file_perms; 143 144 # Access metadata block device used for encryption meta-data. 145 allow vold metadata_block_device:blk_file rw_file_perms; 146 147 # Allow vold to manipulate /data/unencrypted 148 allow vold unencrypted_data_file:{ file } create_file_perms; 149 allow vold unencrypted_data_file:dir create_dir_perms; 150 151 # Write to /proc/sys/vm/drop_caches 152 allow vold proc_drop_caches:file w_file_perms; 153 154 # Give vold a place where only vold can store files; everyone else is off limits 155 allow vold vold_data_file:dir create_dir_perms; 156 allow vold vold_data_file:file create_file_perms; 157 158 # linux keyring configuration 159 allow vold init:key { write search setattr }; 160 allow vold vold:key { write search setattr }; 161 162 # vold temporarily changes its priority when running benchmarks 163 allow vold self:capability sys_nice; 164 165 # vold needs to chroot into app namespaces to remount when runtime permissions change 166 allow vold self:capability sys_chroot; 167 allow vold storage_file:dir mounton; 168 169 # For AppFuse. 170 allow vold fuse_device:chr_file rw_file_perms; 171 allow vold fuse:filesystem { relabelfrom }; 172 allow vold app_fusefs:filesystem { relabelfrom relabelto }; 173 allow vold app_fusefs:filesystem { mount unmount }; 174 175 # MoveTask.cpp executes cp and rm 176 allow vold toolbox_exec:file rx_file_perms; 177 178 # Prepare profile dir for users. 179 allow vold user_profile_data_file:dir create_dir_perms; 180 181 # Raw writes to misc block device 182 allow vold misc_block_device:blk_file w_file_perms; 183 184 neverallow { domain -vold } vold_data_file:dir ~{ open create read getattr setattr search relabelto ioctl }; 185 neverallow { domain -vold -kernel } vold_data_file:notdevfile_class_set ~{ relabelto getattr }; 186 neverallow { domain -vold -init } vold_data_file:dir *; 187 neverallow { domain -vold -init -kernel } vold_data_file:notdevfile_class_set *; 188 neverallow { domain -vold -init } restorecon_prop:property_service set; 189 190 neverallow vold fsck_exec:file execute_no_trans; 191
