diff options
| author | Stephen Smalley <sds@tycho.nsa.gov> | 2014-09-30 11:37:51 -0400 |
|---|---|---|
| committer | Stephen Smalley <sds@tycho.nsa.gov> | 2014-10-02 13:29:25 +0000 |
| commit | 273d7ea4ca29fbd71c2b01e69e2c5ebd1253470a (patch) | |
| tree | 5943c96ccb9aa07d804f8b86fdc678d211307ebd /vold.te | |
| parent | c6cb6ac451b0faf6e9344282a909e910f819a296 (diff) | |
| download | android_external_sepolicy-273d7ea4ca29fbd71c2b01e69e2c5ebd1253470a.tar.gz android_external_sepolicy-273d7ea4ca29fbd71c2b01e69e2c5ebd1253470a.tar.bz2 android_external_sepolicy-273d7ea4ca29fbd71c2b01e69e2c5ebd1253470a.zip | |
Label block devices created or accessed by vold with specific types.
Assign a more specific type than block_device to all
block devices created or accessed by vold. Allow vold
to set the context on the device nodes it creates.
vold can create extra loop devices (/dev/block/loopN) and
block devices for volumes it manages (/dev/block/vold/M:N).
vold can read/write device mapper block devices (/dev/block/dm-N)
created for encrypted volumes.
vold can read/write metadata partitions used to store encryption metadata.
The metadata_block_device type should be assigned in device-specific
policy to the partition specified by the encryptable= mount option
for the userata entry in the fstab.<board> file.
This change does not remove the ability to create or read/write
generic block_device devices by vold, so it should not break anything.
It does add an auditallow statement on such accesses so that we can track
remaining cases where we need to label such device nodes so that we can
ultimately remove this access.
Change-Id: Id3bea28f5958086716cd3db055bea309b3b5fa5a
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Diffstat (limited to 'vold.te')
| -rw-r--r-- | vold.te | 10 |
1 files changed, 8 insertions, 2 deletions
@@ -5,9 +5,11 @@ type vold_exec, exec_type, file_type; init_daemon_domain(vold) typeattribute vold mlstrustedsubject; +allow vold self:process setfscreate; allow vold system_file:file x_file_perms; allow vold block_device:dir create_dir_perms; allow vold block_device:blk_file create_file_perms; +auditallow vold block_device:blk_file create_file_perms; allow vold device:dir write; allow vold devpts:chr_file rw_file_perms; allow vold rootfs:dir mounton; @@ -22,8 +24,10 @@ allow vold self:capability { net_admin dac_override mknod sys_admin chown fowner allow vold self:netlink_kobject_uevent_socket create_socket_perms; allow vold app_data_file:dir search; allow vold app_data_file:file rw_file_perms; -allow vold loop_device:blk_file rw_file_perms; +allow vold loop_device:blk_file create_file_perms; +allow vold vold_device:blk_file create_file_perms; allow vold dm_device:chr_file rw_file_perms; +allow vold dm_device:blk_file rw_file_perms; # For vold Process::killProcessesWithOpenFiles function. allow vold domain:dir r_dir_perms; allow vold domain:{ file lnk_file } r_file_perms; @@ -94,4 +98,6 @@ allow vold tee_device:chr_file rw_file_perms; # Access userdata block device. allow vold userdata_block_device:blk_file rw_file_perms; -auditallow vold userdata_block_device:blk_file rw_file_perms; + +# Access metadata block device used for encryption meta-data. +allow vold metadata_block_device:blk_file rw_file_perms; |