You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
57 lines
1.5 KiB
57 lines
1.5 KiB
# storaged daemon |
|
type storaged, domain, coredomain, mlstrustedsubject; |
|
type storaged_exec, exec_type, file_type; |
|
|
|
init_daemon_domain(storaged) |
|
|
|
# Read access to pseudo filesystems |
|
r_dir_file(storaged, sysfs_type) |
|
r_dir_file(storaged, proc_net) |
|
r_dir_file(storaged, domain) |
|
|
|
# Read /proc/uid_io/stats |
|
allow storaged proc_uid_io_stats:file r_file_perms; |
|
|
|
# Read /data/system/packages.list |
|
allow storaged system_data_file:file r_file_perms; |
|
|
|
userdebug_or_eng(` |
|
# Read access to debugfs |
|
allow storaged debugfs_mmc:dir search; |
|
allow storaged debugfs_mmc:file r_file_perms; |
|
') |
|
|
|
# Needed to provide debug dump output via dumpsys pipes. |
|
allow storaged shell:fd use; |
|
allow storaged shell:fifo_file write; |
|
|
|
# Needed for GMScore to call dumpsys storaged |
|
allow storaged priv_app:fd use; |
|
allow storaged app_data_file:file write; |
|
allow storaged permission_service:service_manager find; |
|
|
|
# Binder permissions |
|
add_service(storaged, storaged_service) |
|
|
|
binder_use(storaged) |
|
binder_call(storaged, system_server) |
|
|
|
# use batteryproperties service |
|
allow storaged batteryproperties_service:service_manager find; |
|
binder_call(storaged, healthd) |
|
|
|
# Implements a dumpsys interface. |
|
allow storaged dumpstate:fd use; |
|
|
|
# use a subset of the package manager service |
|
allow storaged package_native_service:service_manager find; |
|
|
|
# Kernel does extra check on CAP_DAC_OVERRIDE for libbinder when storaged is |
|
# running as root. See b/35323867 #3. |
|
dontaudit storaged self:capability dac_override; |
|
|
|
### |
|
### neverallow |
|
### |
|
neverallow storaged domain:process ptrace; |
|
neverallow storaged self:capability_class_set *;
|
|
|