2012-01-04 09:33:27 -08:00
|
|
|
# init switches to init domain (via init.rc).
|
|
|
|
type init, domain;
|
|
|
|
# init is unconfined.
|
|
|
|
unconfined_domain(init)
|
|
|
|
tmpfs_domain(init)
|
2013-07-10 14:46:05 -07:00
|
|
|
|
2014-02-10 13:31:04 -08:00
|
|
|
allow init self:capability { sys_rawio mknod };
|
|
|
|
|
2014-05-29 11:35:55 -07:00
|
|
|
# Running e2fsck or mkswap via fs_mgr.
|
2014-02-11 11:40:14 -08:00
|
|
|
allow init dev_type:blk_file rw_file_perms;
|
2014-05-29 11:35:55 -07:00
|
|
|
|
|
|
|
# Mounting filesystems.
|
2014-06-16 10:05:38 -07:00
|
|
|
# Only allow relabelto for types used in context= mount options,
|
|
|
|
# which should all be assigned the contextmount_type attribute.
|
|
|
|
# This can be done in device-specific policy via type or typeattribute
|
|
|
|
# declarations.
|
|
|
|
allow init fs_type:filesystem ~relabelto;
|
|
|
|
allow init unlabeled:filesystem ~relabelto;
|
|
|
|
allow init contextmount_type:filesystem relabelto;
|
|
|
|
|
|
|
|
# Allow read-only access to context= mounted filesystems.
|
|
|
|
allow init contextmount_type:dir r_dir_perms;
|
|
|
|
allow init contextmount_type:notdevfile_class_set r_file_perms;
|
2014-05-29 11:35:55 -07:00
|
|
|
|
|
|
|
# restorecon and restorecon_recursive calls from init.rc files.
|
|
|
|
# system/core/init.rc requires at least cache_file and data_file_type.
|
|
|
|
# init.<board>.rc files often include device-specific types, so
|
|
|
|
# we just allow all file types except /system files here.
|
2014-05-20 11:09:16 -07:00
|
|
|
allow init {file_type -system_file -exec_type}:dir_file_class_set relabelto;
|
2014-05-29 11:35:55 -07:00
|
|
|
|
2014-05-30 06:53:00 -07:00
|
|
|
# Unlabeled file access for upgrades from 4.2.
|
|
|
|
allow init unlabeled:dir { create_dir_perms relabelfrom };
|
|
|
|
allow init unlabeled:notdevfile_class_set { create_file_perms relabelfrom };
|
|
|
|
|
2014-05-30 07:25:00 -07:00
|
|
|
# Create /data/security from init.rc post-fs-data.
|
|
|
|
allow init security_file:dir { create setattr };
|
|
|
|
|
|
|
|
# setprop selinux.reload_policy 1 from init.rc post-fs-data.
|
|
|
|
allow init security_prop:property_service set;
|
|
|
|
|
2014-05-29 11:35:55 -07:00
|
|
|
# Reload policy upon setprop selinux.reload_policy 1.
|
2014-05-30 07:25:00 -07:00
|
|
|
r_dir_file(init, security_file)
|
2013-12-06 05:05:53 -08:00
|
|
|
allow init kernel:security load_policy;
|
2014-05-29 11:35:55 -07:00
|
|
|
|
|
|
|
# Any operation that can modify the kernel ring buffer, e.g. clear
|
|
|
|
# or a read that consumes the messages that were read.
|
2014-05-28 13:48:52 -07:00
|
|
|
allow init kernel:system syslog_mod;
|
2014-05-29 11:35:55 -07:00
|
|
|
|
|
|
|
# Set usermodehelpers and /proc security settings.
|
2013-12-06 06:31:40 -08:00
|
|
|
allow init usermodehelper:file rw_file_perms;
|
|
|
|
allow init proc_security:file rw_file_perms;
|
2014-01-24 20:43:07 -08:00
|
|
|
|
|
|
|
# Transitions to seclabel processes in init.rc
|
|
|
|
allow init adbd:process transition;
|
|
|
|
allow init healthd:process transition;
|
|
|
|
allow init recovery:process transition;
|
|
|
|
allow init shell:process transition;
|
|
|
|
allow init ueventd:process transition;
|
|
|
|
allow init watchdogd:process transition;
|
2014-05-08 23:28:52 -07:00
|
|
|
|
|
|
|
# Init creates keystore's directory on boot, and walks through
|
|
|
|
# the directory as part of a recursive restorecon.
|
|
|
|
allow init keystore_data_file:dir { open create read getattr setattr search };
|
|
|
|
allow init keystore_data_file:file { getattr };
|
2014-05-23 08:26:19 -07:00
|
|
|
|
2014-06-07 10:00:59 -07:00
|
|
|
# Init creates /data/local/tmp at boot
|
|
|
|
allow init shell_data_file:dir { open create read getattr setattr search };
|
|
|
|
allow init shell_data_file:file { getattr };
|
|
|
|
|
2014-05-23 08:26:19 -07:00
|
|
|
# Use setexeccon(), setfscreatecon(), and setsockcreatecon().
|
|
|
|
# setexec is for services with seclabel options.
|
|
|
|
# setfscreate is for labeling directories and socket files.
|
|
|
|
# setsockcreate is for labeling local/unix domain sockets.
|
|
|
|
allow init self:process { setexec setfscreate setsockcreate };
|
2014-05-29 06:22:16 -07:00
|
|
|
|
|
|
|
# Create /data/property and files within it.
|
|
|
|
allow init property_data_file:dir create_dir_perms;
|
|
|
|
allow init property_data_file:file create_file_perms;
|
2014-06-18 07:09:35 -07:00
|
|
|
|
|
|
|
###
|
|
|
|
### neverallow rules
|
|
|
|
###
|
|
|
|
|
|
|
|
# The init domain is only entered via setcon from the kernel domain,
|
|
|
|
# never via an exec-based transition.
|
|
|
|
neverallow { domain -kernel} init:process dyntransition;
|
|
|
|
neverallow domain init:process transition;
|
|
|
|
neverallow init { file_type fs_type }:file entrypoint;
|