1# sgdisk called from vold
2type sgdisk, domain, domain_deprecated;
3type sgdisk_exec, exec_type, file_type;
4
5# Allowed to read/write low-level partition tables
6allow sgdisk block_device:dir search;
7allow sgdisk vold_device:blk_file rw_file_perms;
8
9# Inherit and use pty created by android_fork_execvp()
10allow sgdisk devpts:chr_file { read write ioctl getattr };
11
12# Allow stdin/out back to vold
13allow sgdisk vold:fd use;
14allow sgdisk vold:fifo_file { read write getattr };
15
16# Used to probe kernel to reload partition tables
17allow sgdisk self:capability sys_admin;
18
19# Only allow entry from vold
20neverallow { domain -vold } sgdisk:process transition;
21neverallow * sgdisk:process dyntransition;
22neverallow sgdisk { file_type fs_type -sgdisk_exec }:file entrypoint;
23