1# volume manager
2type vold, domain;
3type vold_exec, exec_type, file_type;
4
5init_daemon_domain(vold)
6
7# Switch to more restrictive domains when executing common tools
8domain_auto_trans(vold, sgdisk_exec, sgdisk);
9domain_auto_trans(vold, sdcardd_exec, sdcardd);
10
11# For a handful of probing tools, we choose an even more restrictive
12# domain when working with untrusted block devices
13domain_trans(vold, shell_exec, blkid);
14domain_trans(vold, shell_exec, blkid_untrusted);
15domain_trans(vold, fsck_exec, fsck);
16domain_trans(vold, fsck_exec, fsck_untrusted);
17
18# Allow us to jump into execution domains of above tools
19allow vold self:process setexec;
20
21# For sgdisk launched through popen()
22allow vold shell_exec:file rx_file_perms;
23
24typeattribute vold mlstrustedsubject;
25allow vold self:process setfscreate;
26allow vold system_file:file x_file_perms;
27allow vold block_device:dir create_dir_perms;
28allow vold block_device:blk_file create_file_perms;
29auditallow vold block_device:blk_file create_file_perms;
30allow vold device:dir write;
31allow vold devpts:chr_file rw_file_perms;
32allow vold rootfs:dir mounton;
33allow vold sdcard_type:dir mounton; # TODO: deprecated in M
34allow vold sdcard_type:filesystem { mount remount unmount }; # TODO: deprecated in M
35allow vold sdcard_type:dir create_dir_perms; # TODO: deprecated in M
36allow vold sdcard_type:file create_file_perms; # TODO: deprecated in M
37
38# Manage locations where storage is mounted
39allow vold { mnt_media_rw_file storage_file sdcard_type }:dir create_dir_perms;
40allow vold { mnt_media_rw_file storage_file sdcard_type }:file create_file_perms;
41
42# Access to storage that backs emulated FUSE daemons for migration optimization
43allow vold media_rw_data_file:dir create_dir_perms;
44allow vold media_rw_data_file:file create_file_perms;
45
46# Newly created storage dirs are always treated as mount stubs to prevent us
47# from accidentally writing when the mount point isn't present.
48type_transition vold storage_file:dir storage_stub_file;
49type_transition vold mnt_media_rw_file:dir mnt_media_rw_stub_file;
50
51# Allow mounting of storage devices
52allow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr };
53allow vold sdcard_type:filesystem { mount unmount remount };
54
55# Manage per-user primary symlinks
56allow vold mnt_user_file:dir create_dir_perms;
57allow vold mnt_user_file:lnk_file create_file_perms;
58
59# Allow to create and mount expanded storage
60allow vold mnt_expand_file:dir { create_dir_perms mounton };
61allow vold apk_data_file:dir { create getattr setattr };
62allow vold shell_data_file:dir { create getattr setattr };
63
64allow vold tmpfs:filesystem { mount unmount };
65allow vold tmpfs:dir create_dir_perms;
66allow vold tmpfs:dir mounton;
67allow vold self:capability { net_admin dac_override mknod sys_admin chown fowner fsetid };
68allow vold self:netlink_kobject_uevent_socket create_socket_perms;
69allow vold app_data_file:dir search;
70allow vold app_data_file:file rw_file_perms;
71allow vold loop_device:blk_file create_file_perms;
72allow vold vold_device:blk_file create_file_perms;
73allow vold dm_device:chr_file rw_file_perms;
74allow vold dm_device:blk_file rw_file_perms;
75# For vold Process::killProcessesWithOpenFiles function.
76allow vold domain:dir r_dir_perms;
77allow vold domain:{ file lnk_file } r_file_perms;
78allow vold domain:process { signal sigkill };
79allow vold self:capability { sys_ptrace kill };
80
81# XXX Label sysfs files with a specific type?
82allow vold sysfs:file rw_file_perms;
83
84allow vold kmsg_device:chr_file rw_file_perms;
85
86# Run fsck.
87allow vold fsck_exec:file rx_file_perms;
88
89# Log fsck results
90allow vold fscklogs:dir rw_dir_perms;
91allow vold fscklogs:file create_file_perms;
92
93#
94# Rules to support encrypted fs support.
95#
96
97# Unmount and mount the fs.
98allow vold labeledfs:filesystem { mount unmount remount };
99
100# Access /efs/userdata_footer.
101# XXX Split into a separate type?
102allow vold efs_file:file rw_file_perms;
103
104# Create and mount on /data/tmp_mnt and management of expansion mounts
105allow vold system_data_file:dir { create rw_dir_perms mounton setattr rmdir };
106
107# Set scheduling policy of kernel processes
108allow vold kernel:process setsched;
109
110# Property Service
111set_prop(vold, vold_prop)
112set_prop(vold, powerctl_prop)
113set_prop(vold, ctl_fuse_prop)
114set_prop(vold, restorecon_prop)
115
116# ASEC
117allow vold asec_image_file:file create_file_perms;
118allow vold asec_image_file:dir rw_dir_perms;
119security_access_policy(vold)
120allow vold asec_apk_file:dir { create_dir_perms mounton relabelfrom relabelto };
121allow vold asec_public_file:dir { relabelto setattr };
122allow vold asec_apk_file:file { r_file_perms setattr relabelfrom relabelto };
123allow vold asec_public_file:file { relabelto setattr };
124# restorecon files in asec containers created on 4.2 or earlier.
125allow vold unlabeled:dir { r_dir_perms setattr relabelfrom };
126allow vold unlabeled:file { r_file_perms setattr relabelfrom };
127
128# Handle wake locks (used for device encryption)
129wakelock_use(vold)
130
131# talk to batteryservice
132binder_use(vold)
133binder_call(vold, healthd)
134
135# talk to keymaster
136allow vold tee_device:chr_file rw_file_perms;
137
138# Access userdata block device.
139allow vold userdata_block_device:blk_file rw_file_perms;
140
141# Access metadata block device used for encryption meta-data.
142allow vold metadata_block_device:blk_file rw_file_perms;
143
144# Allow vold to manipulate /data/unencrypted
145allow vold unencrypted_data_file:{ file } create_file_perms;
146allow vold unencrypted_data_file:dir create_dir_perms;
147
148# Write to /proc/sys/vm/drop_caches
149allow vold proc_drop_caches:file w_file_perms;
150
151# Give vold a place where only vold can store files; everyone else is off limits
152allow vold vold_data_file:dir create_dir_perms;
153allow vold vold_data_file:file create_file_perms;
154
155# linux keyring configuration
156allow vold init:key { write search setattr };
157allow vold vold:key { write search setattr };
158
159# vold temporarily changes its priority when running benchmarks
160allow vold self:capability sys_nice;
161
162# vold needs to chroot into app namespaces to remount when runtime permissions change
163allow vold self:capability sys_chroot;
164allow vold storage_file:dir mounton;
165
166neverallow { domain -vold } vold_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
167neverallow { domain -vold } vold_data_file:notdevfile_class_set ~{ relabelto getattr };
168neverallow { domain -vold -init } vold_data_file:dir *;
169neverallow { domain -vold -init } vold_data_file:notdevfile_class_set *;
170neverallow { domain -vold -init } restorecon_prop:property_service set;
171