android_system_sepolicy/sdcardd.te

type sdcardd, domain;
type sdcardd_exec, exec_type, file_type;

init_daemon_domain(sdcardd)
unconfined_domain(sdcardd)

type_transition sdcardd system_data_file:{ dir file } media_rw_data_file;
allow sdcardd media_rw_data_file:dir create_dir_perms;
allow sdcardd media_rw_data_file:file create_file_perms;
sdcard policy and fuse device label. 2012-05-31 06:44:51 -07:00			`type sdcardd, domain;`
			`type sdcardd_exec, exec_type, file_type;`

			`init_daemon_domain(sdcardd)`
Make all domains unconfined. This prevents denials from being generated by the base policy. Over time, these rules will be incrementally tightened to improve security. Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11 2013-05-17 17:11:29 -07:00			`unconfined_domain(sdcardd)`
Label /data/media with its own type and allow access. /data/media presently is left in system_data_file, which requires anything that wants to write to it to be able to write to system_data_file. Introduce a new type for /data/media, media_rw_data_file (to match the media_rw UID assigned to it and distinguish it from /data/misc/media which has media UID and media_data_file type), and allow access to it. We allow this for all platform app domains as WRITE_MEDIA_STORAGE permission is granted to signature\|system. We should not have to allow it to untrusted_app. Set up type transitions in sdcardd to automatically label any directories or files it creates with the new type. Change-Id: I5c7e6245b854a9213099e40a41d9583755d37d42 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-12-17 11:39:35 -08:00
			`type_transition sdcardd system_data_file:{ dir file } media_rw_data_file;`
			`allow sdcardd media_rw_data_file:dir create_dir_perms;`
			`allow sdcardd media_rw_data_file:file create_file_perms;`