From 5850a2ae6b38a72e4a1e83a62d05a5b2880c49d9 Mon Sep 17 00:00:00 2001 From: Paul Crowley Date: Wed, 25 Oct 2017 13:03:24 -0700 Subject: [PATCH] Move most of public/vold_prepare_subdirs.te to private AIUI permissions should be in private unless they need to be public. Bug: 25861755 Test: Boot device, create and remove a user, observe logs Change-Id: I6c3521d50dab2d508fce4b614d51e163e7c8f3da --- private/vold_prepare_subdirs.te | 12 ++++++++++++ public/vold_prepare_subdirs.te | 13 ------------- 2 files changed, 12 insertions(+), 13 deletions(-) diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te index 7360e5848..3f17ce5c6 100644 --- a/private/vold_prepare_subdirs.te +++ b/private/vold_prepare_subdirs.te @@ -1,3 +1,15 @@ domain_auto_trans(vold, vold_prepare_subdirs_exec, vold_prepare_subdirs) +allow vold_prepare_subdirs system_file:file execute_no_trans; +allow vold_prepare_subdirs shell_exec:file rx_file_perms; +allow vold_prepare_subdirs toolbox_exec:file rx_file_perms; +allow vold_prepare_subdirs devpts:chr_file rw_file_perms; +allow vold_prepare_subdirs vold:fd use; +allow vold_prepare_subdirs vold:fifo_file { read write }; +allow vold_prepare_subdirs file_contexts_file:file r_file_perms; +allow vold_prepare_subdirs self:capability dac_override; +allow vold_prepare_subdirs self:process setfscreate; +allow vold_prepare_subdirs system_data_file:dir { open read write add_name remove_name }; +allow vold_prepare_subdirs vold_data_file:dir { create open read write search getattr setattr remove_name rmdir }; +allow vold_prepare_subdirs vold_data_file:file { getattr unlink }; allow vold_prepare_subdirs storaged_data_file:dir create_dir_perms; diff --git a/public/vold_prepare_subdirs.te b/public/vold_prepare_subdirs.te index 1476a8c67..6405d2dcb 100644 --- a/public/vold_prepare_subdirs.te +++ b/public/vold_prepare_subdirs.te @@ -4,16 +4,3 @@ type vold_prepare_subdirs, domain; type vold_prepare_subdirs_exec, exec_type, file_type; typeattribute vold_prepare_subdirs coredomain; - -allow vold_prepare_subdirs system_file:file execute_no_trans; -allow vold_prepare_subdirs shell_exec:file rx_file_perms; -allow vold_prepare_subdirs toolbox_exec:file rx_file_perms; -allow vold_prepare_subdirs devpts:chr_file rw_file_perms; -allow vold_prepare_subdirs vold:fd use; -allow vold_prepare_subdirs vold:fifo_file { read write }; -allow vold_prepare_subdirs file_contexts_file:file r_file_perms; -allow vold_prepare_subdirs self:capability dac_override; -allow vold_prepare_subdirs self:process setfscreate; -allow vold_prepare_subdirs system_data_file:dir { open read write add_name remove_name }; -allow vold_prepare_subdirs vold_data_file:dir { create open read write search getattr setattr remove_name rmdir }; -allow vold_prepare_subdirs vold_data_file:file { getattr unlink };