79d36513cc
Add support for the HDIO_GETGEO and BLKGETSIZE ioctls when operating on /dev/block/vold/ block devices. HDIO_GETGEO is needed by the sgdisk code to get the number of heads on the disk drive, likely a side effect of the age of this code.646af625ce/diskio-unix.cc (193)Addresses the following denial: audit(0.0:1775): avc: denied { ioctl } for comm="sgdisk" path="/dev/block/vold/disk:8,96" dev="tmpfs" ino=10740855 ioctlcmd=0x301 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file permissive=0 BLKGETSIZE is used to determine the size of the block device. Ideally code should not be using this ioctl, as it fails for devices >= 2T in size. Technically we don't need to grant this, as the sgdisk code will fall back to using BLKGETSIZE64 if BLKGETSIZE fails.646af625ce/diskio-unix.cc (430)Addresses the following denial: audit(0.0:1778): avc: denied { ioctl } for comm="sgdisk" path="/dev/block/vold/disk:8,96" dev="tmpfs" ino=10740855 ioctlcmd=0x1260 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file permissive=0 Test: policy compiles. Change-Id: Iaa5274721e8a7d1741591570e9e5305723aad640
33 lines
1.3 KiB
Plaintext
33 lines
1.3 KiB
Plaintext
# sgdisk called from vold
|
|
type sgdisk, domain;
|
|
type sgdisk_exec, system_file_type, exec_type, file_type;
|
|
|
|
# Allowed to read/write low-level partition tables
|
|
allow sgdisk block_device:dir search;
|
|
allow sgdisk vold_device:blk_file rw_file_perms;
|
|
# HDIO_GETGEO needed to get the number of disk heads
|
|
# on vold_device. How quaint.
|
|
allowxperm sgdisk vold_device:blk_file ioctl { HDIO_GETGEO };
|
|
# sgdisk also uses BLKGETSIZE and BLKGETSIZE64. BLKGETSIZE64
|
|
# is granted to all block device users in domain.te, so
|
|
# no need to mention it here. sgdisk should not be
|
|
# using the BLKGETSIZE ioctl as it is useless for devices over
|
|
# 2T in size, but we allow it for now and hope that sgdisk
|
|
# will fix their bug.
|
|
allowxperm sgdisk vold_device:blk_file ioctl { BLKGETSIZE };
|
|
|
|
# Inherit and use pty created by android_fork_execvp()
|
|
allow sgdisk devpts:chr_file { read write ioctl getattr };
|
|
|
|
# Allow stdin/out back to vold
|
|
allow sgdisk vold:fd use;
|
|
allow sgdisk vold:fifo_file { read write getattr };
|
|
|
|
# Used to probe kernel to reload partition tables
|
|
allow sgdisk self:global_capability_class_set sys_admin;
|
|
|
|
# Only allow entry from vold
|
|
neverallow { domain -vold } sgdisk:process transition;
|
|
neverallow * sgdisk:process dyntransition;
|
|
neverallow sgdisk { file_type fs_type -sgdisk_exec }:file entrypoint;
|