You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
22 lines
740 B
22 lines
740 B
# sgdisk called from vold |
|
type sgdisk, domain; |
|
type sgdisk_exec, exec_type, file_type; |
|
|
|
# Allowed to read/write low-level partition tables |
|
allow sgdisk block_device:dir search; |
|
allow sgdisk vold_device:blk_file rw_file_perms; |
|
|
|
# Inherit and use pty created by android_fork_execvp() |
|
allow sgdisk devpts:chr_file { read write ioctl getattr }; |
|
|
|
# Allow stdin/out back to vold |
|
allow sgdisk vold:fd use; |
|
allow sgdisk vold:fifo_file { read write getattr }; |
|
|
|
# Used to probe kernel to reload partition tables |
|
allow sgdisk self:capability sys_admin; |
|
|
|
# Only allow entry from vold |
|
neverallow { domain -vold } sgdisk:process transition; |
|
neverallow * sgdisk:process dyntransition; |
|
neverallow sgdisk { file_type fs_type -sgdisk_exec }:file entrypoint;
|
|
|