1# volume manager
2type vold, domain, domain_deprecated;
3type vold_exec, exec_type, file_type;
4
5init_daemon_domain(vold)
6
7# Switch to more restrictive domains when executing common tools
8domain_auto_trans(vold, sgdisk_exec, sgdisk);
9domain_auto_trans(vold, sdcardd_exec, sdcardd);
10
11# Read already opened /cache files.
12allow vold cache_file:dir r_dir_perms;
13allow vold cache_file:file { getattr read };
14allow vold cache_file:lnk_file r_file_perms;
15
16# Read access to pseudo filesystems.
17r_dir_file(vold, proc)
18r_dir_file(vold, proc_net)
19r_dir_file(vold, sysfs)
20r_dir_file(vold, rootfs)
21
22# For a handful of probing tools, we choose an even more restrictive
23# domain when working with untrusted block devices
24domain_trans(vold, shell_exec, blkid);
25domain_trans(vold, shell_exec, blkid_untrusted);
26domain_trans(vold, fsck_exec, fsck);
27domain_trans(vold, fsck_exec, fsck_untrusted);
28
29# Allow us to jump into execution domains of above tools
30allow vold self:process setexec;
31
32# For sgdisk launched through popen()
33allow vold shell_exec:file rx_file_perms;
34
35typeattribute vold mlstrustedsubject;
36allow vold self:process setfscreate;
37allow vold system_file:file x_file_perms;
38allow vold block_device:dir create_dir_perms;
39allow vold device:dir write;
40allow vold devpts:chr_file rw_file_perms;
41allow vold rootfs:dir mounton;
42allow vold sdcard_type:dir mounton; # TODO: deprecated in M
43allow vold sdcard_type:filesystem { mount remount unmount }; # TODO: deprecated in M
44allow vold sdcard_type:dir create_dir_perms; # TODO: deprecated in M
45allow vold sdcard_type:file create_file_perms; # TODO: deprecated in M
46
47# Manage locations where storage is mounted
48allow vold { mnt_media_rw_file storage_file sdcard_type }:dir create_dir_perms;
49allow vold { mnt_media_rw_file storage_file sdcard_type }:file create_file_perms;
50
51# Access to storage that backs emulated FUSE daemons for migration optimization
52allow vold media_rw_data_file:dir create_dir_perms;
53allow vold media_rw_data_file:file create_file_perms;
54
55# Newly created storage dirs are always treated as mount stubs to prevent us
56# from accidentally writing when the mount point isn't present.
57type_transition vold storage_file:dir storage_stub_file;
58type_transition vold mnt_media_rw_file:dir mnt_media_rw_stub_file;
59
60# Allow mounting of storage devices
61allow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr };
62allow vold sdcard_type:filesystem { mount unmount remount };
63
64# Manage per-user primary symlinks
65allow vold mnt_user_file:dir create_dir_perms;
66allow vold mnt_user_file:lnk_file create_file_perms;
67
68# Allow to create and mount expanded storage
69allow vold mnt_expand_file:dir { create_dir_perms mounton };
70allow vold apk_data_file:dir { create getattr setattr };
71allow vold shell_data_file:dir { create getattr setattr };
72
73allow vold tmpfs:filesystem { mount unmount };
74allow vold tmpfs:dir create_dir_perms;
75allow vold tmpfs:dir mounton;
76allow vold self:capability { net_admin dac_override mknod sys_admin chown fowner fsetid };
77allow vold self:netlink_kobject_uevent_socket create_socket_perms;
78allow vold app_data_file:dir search;
79allow vold app_data_file:file rw_file_perms;
80allow vold loop_device:blk_file create_file_perms;
81allow vold vold_device:blk_file create_file_perms;
82allow vold dm_device:chr_file rw_file_perms;
83allow vold dm_device:blk_file rw_file_perms;
84# For vold Process::killProcessesWithOpenFiles function.
85allow vold domain:dir r_dir_perms;
86allow vold domain:{ file lnk_file } r_file_perms;
87allow vold domain:process { signal sigkill };
88allow vold self:capability { sys_ptrace kill };
89
90# XXX Label sysfs files with a specific type?
91allow vold sysfs:file rw_file_perms;
92
93# TODO: added to match above sysfs rule. Remove me?
94allow vold sysfs_usb:file w_file_perms;
95
96allow vold kmsg_device:chr_file rw_file_perms;
97
98# Run fsck in the fsck domain.
99allow vold fsck_exec:file { r_file_perms execute };
100
101# Log fsck results
102allow vold fscklogs:dir rw_dir_perms;
103allow vold fscklogs:file create_file_perms;
104
105#
106# Rules to support encrypted fs support.
107#
108
109# Unmount and mount the fs.
110allow vold labeledfs:filesystem { mount unmount remount };
111
112# Access /efs/userdata_footer.
113# XXX Split into a separate type?
114allow vold efs_file:file rw_file_perms;
115
116# Create and mount on /data/tmp_mnt and management of expansion mounts
117allow vold system_data_file:dir { create rw_dir_perms mounton setattr rmdir };
118
119# Set scheduling policy of kernel processes
120allow vold kernel:process setsched;
121
122# Property Service
123set_prop(vold, vold_prop)
124set_prop(vold, powerctl_prop)
125set_prop(vold, ctl_fuse_prop)
126set_prop(vold, restorecon_prop)
127
128# ASEC
129allow vold asec_image_file:file create_file_perms;
130allow vold asec_image_file:dir rw_dir_perms;
131security_access_policy(vold)
132allow vold asec_apk_file:dir { create_dir_perms mounton relabelfrom relabelto };
133allow vold asec_public_file:dir { relabelto setattr };
134allow vold asec_apk_file:file { r_file_perms setattr relabelfrom relabelto };
135allow vold asec_public_file:file { relabelto setattr };
136# restorecon files in asec containers created on 4.2 or earlier.
137allow vold unlabeled:dir { r_dir_perms setattr relabelfrom };
138allow vold unlabeled:file { r_file_perms setattr relabelfrom };
139
140# Handle wake locks (used for device encryption)
141wakelock_use(vold)
142
143# talk to batteryservice
144binder_use(vold)
145binder_call(vold, healthd)
146
147# talk to keymaster
148allow vold tee_device:chr_file rw_file_perms;
149
150# Access userdata block device.
151allow vold userdata_block_device:blk_file rw_file_perms;
152
153# Access metadata block device used for encryption meta-data.
154allow vold metadata_block_device:blk_file rw_file_perms;
155
156# Allow vold to manipulate /data/unencrypted
157allow vold unencrypted_data_file:{ file } create_file_perms;
158allow vold unencrypted_data_file:dir create_dir_perms;
159
160# Write to /proc/sys/vm/drop_caches
161allow vold proc_drop_caches:file w_file_perms;
162
163# Give vold a place where only vold can store files; everyone else is off limits
164allow vold vold_data_file:dir create_dir_perms;
165allow vold vold_data_file:file create_file_perms;
166
167# linux keyring configuration
168allow vold init:key { write search setattr };
169allow vold vold:key { write search setattr };
170
171# vold temporarily changes its priority when running benchmarks
172allow vold self:capability sys_nice;
173
174# vold needs to chroot into app namespaces to remount when runtime permissions change
175allow vold self:capability sys_chroot;
176allow vold storage_file:dir mounton;
177
178# For AppFuse.
179allow vold fuse_device:chr_file rw_file_perms;
180allow vold fuse:filesystem { relabelfrom };
181allow vold app_fusefs:filesystem { relabelfrom relabelto };
182allow vold app_fusefs:filesystem { mount unmount };
183
184# coldboot of /sys/block
185allow vold sysfs_zram:dir r_dir_perms;
186allow vold sysfs_zram_uevent:file rw_file_perms;
187
188# MoveTask.cpp executes cp and rm
189allow vold toolbox_exec:file rx_file_perms;
190
191# Prepare profile dir for users.
192allow vold user_profile_data_file:dir create_dir_perms;
193allow vold user_profile_foreign_dex_data_file:dir { getattr setattr };
194
195# Raw writes to misc block device
196allow vold misc_block_device:blk_file w_file_perms;
197
198neverallow { domain -vold } vold_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
199neverallow { domain -vold } vold_data_file:notdevfile_class_set ~{ relabelto getattr };
200neverallow { domain -vold -init } vold_data_file:dir *;
201neverallow { domain -vold -init } vold_data_file:notdevfile_class_set *;
202neverallow { domain -vold -init } restorecon_prop:property_service set;
203
204neverallow vold fsck_exec:file execute_no_trans;
205