2018-08-17 00:35:42 -07:00
|
|
|
typeattribute apexd coredomain;
|
|
|
|
|
|
|
|
init_daemon_domain(apexd)
|
|
|
|
|
|
|
|
# Read /system/etc/security/apex_debug_key
|
2018-10-12 03:21:12 -07:00
|
|
|
allow apexd apex_key_file:dir { search getattr };
|
2018-08-17 00:35:42 -07:00
|
|
|
allow apexd apex_key_file:file r_file_perms;
|
|
|
|
|
2019-01-14 00:10:24 -08:00
|
|
|
# Allow creating, reading and writing of APEX files/dirs in the APEX data dir
|
|
|
|
allow apexd apex_data_file:dir create_dir_perms;
|
|
|
|
allow apexd apex_data_file:file create_file_perms;
|
2018-08-17 00:35:42 -07:00
|
|
|
|
|
|
|
# allow apexd to create loop devices with /dev/loop-control
|
|
|
|
allow apexd loop_control_device:chr_file rw_file_perms;
|
|
|
|
# allow apexd to access loop devices
|
|
|
|
allow apexd loop_device:blk_file rw_file_perms;
|
2018-10-26 05:32:44 -07:00
|
|
|
allowxperm apexd loop_device:blk_file ioctl {
|
|
|
|
LOOP_GET_STATUS64
|
|
|
|
LOOP_SET_STATUS64
|
|
|
|
LOOP_SET_FD
|
|
|
|
LOOP_SET_BLOCK_SIZE
|
|
|
|
LOOP_SET_DIRECT_IO
|
|
|
|
LOOP_CLR_FD
|
2018-12-14 01:33:01 -08:00
|
|
|
BLKFLSBUF
|
2018-10-26 05:32:44 -07:00
|
|
|
};
|
2018-08-17 00:35:42 -07:00
|
|
|
# allow apexd to access /dev/block
|
|
|
|
allow apexd block_device:dir r_dir_perms;
|
|
|
|
|
|
|
|
# allow apexd to access /dev/block/dm-* (device-mapper entries)
|
|
|
|
allow apexd dm_device:chr_file rw_file_perms;
|
|
|
|
allow apexd dm_device:blk_file rw_file_perms;
|
|
|
|
|
|
|
|
# sys_admin is required to access the device-mapper and mount
|
|
|
|
allow apexd self:global_capability_class_set sys_admin;
|
|
|
|
|
|
|
|
# allow apexd to create a mount point in /apex
|
|
|
|
allow apexd apex_mnt_dir:dir create_dir_perms;
|
|
|
|
# allow apexd to mount in /apex
|
|
|
|
allow apexd apex_mnt_dir:filesystem { mount unmount };
|
|
|
|
allow apexd apex_mnt_dir:dir mounton;
|
2018-10-16 00:02:49 -07:00
|
|
|
# allow apexd to create symlinks in /apex
|
|
|
|
allow apexd apex_mnt_dir:lnk_file create_file_perms;
|
|
|
|
|
2018-12-03 03:50:37 -08:00
|
|
|
# allow apexd to relabel apk_tmp_file to apex_data_file.
|
|
|
|
# TODO(b/112669193) remove this when APEXes are staged via file descriptor
|
|
|
|
allow apexd apk_tmp_file:file relabelfrom;
|
|
|
|
allow apexd apex_data_file:file relabelto;
|
|
|
|
|
2019-01-02 06:20:52 -08:00
|
|
|
# allow apexd to read files from /data/staging and hardlink them to /data/apex.
|
|
|
|
allow apexd staging_data_file:dir r_dir_perms;
|
|
|
|
allow apexd staging_data_file:file { r_file_perms link };
|
|
|
|
|
2018-08-17 00:35:42 -07:00
|
|
|
# Unmount and mount filesystems
|
|
|
|
allow apexd labeledfs:filesystem { mount unmount };
|
|
|
|
|
2018-12-18 06:38:59 -08:00
|
|
|
# Configure read-ahead of dm-verity and loop devices
|
|
|
|
# for dm-X
|
2018-11-08 03:57:12 -08:00
|
|
|
allow apexd sysfs_dm:dir r_dir_perms;
|
|
|
|
allow apexd sysfs_dm:file rw_file_perms;
|
2018-12-18 06:38:59 -08:00
|
|
|
# for loopX
|
|
|
|
allow apexd sysfs_loop:dir r_dir_perms;
|
|
|
|
allow apexd sysfs_loop:file rw_file_perms;
|
2018-11-08 03:57:12 -08:00
|
|
|
|
2018-08-17 00:35:42 -07:00
|
|
|
# Spawning a libbinder thread results in a dac_override deny,
|
|
|
|
# /dev/cpuset/tasks is owned by system.
|
|
|
|
#
|
|
|
|
# See b/35323867#comment3
|
|
|
|
dontaudit apexd self:global_capability_class_set { dac_override dac_read_search };
|
|
|
|
|
2019-01-23 12:44:24 -08:00
|
|
|
# Allow apexd to log to the kernel.
|
|
|
|
allow apexd kmsg_device:chr_file w_file_perms;
|
|
|
|
|
2018-08-17 00:35:42 -07:00
|
|
|
neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms;
|
2019-01-04 08:22:19 -08:00
|
|
|
neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms;
|
2018-10-16 00:02:49 -07:00
|
|
|
neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms;
|