123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114 |
- typeattribute apexd coredomain;
- init_daemon_domain(apexd)
- allow apexd apex_data_file:dir create_dir_perms;
- allow apexd apex_data_file:file create_file_perms;
- allow apexd metadata_file:dir search;
- allow apexd apex_metadata_file:dir create_dir_perms;
- allow apexd apex_metadata_file:file create_file_perms;
- allow apexd loop_control_device:chr_file rw_file_perms;
- allow apexd loop_device:blk_file rw_file_perms;
- allowxperm apexd loop_device:blk_file ioctl {
- LOOP_GET_STATUS64
- LOOP_SET_STATUS64
- LOOP_SET_FD
- LOOP_SET_BLOCK_SIZE
- LOOP_SET_DIRECT_IO
- LOOP_CLR_FD
- BLKFLSBUF
- };
- allow apexd block_device:dir r_dir_perms;
- allow apexd dm_device:chr_file rw_file_perms;
- allow apexd dm_device:blk_file rw_file_perms;
- allow apexd self:global_capability_class_set sys_admin;
- allow apexd apex_mnt_dir:dir create_dir_perms;
- allow apexd apex_mnt_dir:filesystem { mount unmount };
- allow apexd apex_mnt_dir:dir mounton;
- allow apexd apex_mnt_dir:lnk_file create_file_perms;
- allow apexd staging_data_file:file unlink;
- allow apexd staging_data_file:dir r_dir_perms;
- allow apexd staging_data_file:file { r_file_perms link };
- allow apexd labeledfs:filesystem { mount unmount };
- allow apexd sysfs_type:dir search;
- allow apexd sysfs_dm:dir r_dir_perms;
- allow apexd sysfs_dm:file rw_file_perms;
- allow apexd sysfs_loop:dir r_dir_perms;
- allow apexd sysfs_loop:file rw_file_perms;
- dontaudit apexd self:global_capability_class_set { dac_override dac_read_search };
- allow apexd kmsg_device:chr_file w_file_perms;
- set_prop(apexd, powerctl_prop)
- allow apexd vold_service:service_manager find;
- binder_call(apexd, vold)
- allow apexd apexd_exec:file execute_no_trans;
- allow apexd rootfs:dir mounton;
- allow apexd shell_exec:file { r_file_perms execute };
- allow apexd system_bootstrap_lib_file:dir r_dir_perms;
- allow apexd system_bootstrap_lib_file:file { execute read open getattr map };
- domain_auto_trans(apexd, art_apex_preinstall_exec, art_apex_preinstall)
- domain_auto_trans(apexd, art_apex_postinstall_exec, art_apex_postinstall)
- userdebug_or_eng(`
- domain_auto_trans(apexd, apex_test_prepostinstall_exec, apex_test_prepostinstall)
- ')
- neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms;
- neverallow { domain -apexd -init } apex_metadata_file:dir no_w_dir_perms;
- neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms;
- neverallow { domain -apexd -init -kernel } apex_metadata_file:file no_w_file_perms;
- neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms;
|