Separate fsck domains to protect userdata.

Create new vold_fsck domain that only has access to vold_block
devices to prevent any access to internal userdata.

Change-Id: I25ddcd16cbf83d7a25b70bc64d95f5345d0d5731

1 files changed, 1 insertions, 1 deletions

diff --git a/vold.te b/vold.te
index cde7c77..0a42b2d 100644
--- a/vold.te
+++ b/vold.te
@@ -8,7 +8,7 @@ init_daemon_domain(vold)
 domain_auto_trans(vold, sgdisk_exec, sgdisk);
 domain_auto_trans(vold, blkid_exec, blkid);
 domain_auto_trans(vold, sdcardd_exec, sdcardd);
-domain_auto_trans(vold, fsck_exec, fsck);
+domain_auto_trans(vold, fsck_exec, vold_fsck);
 
 typeattribute vold mlstrustedsubject;
 allow vold self:process setfscreate;