1typeattribute apexd coredomain; 2 3init_daemon_domain(apexd) 4 5# Allow creating, reading and writing of APEX files/dirs in the APEX data dir 6allow apexd apex_data_file:dir create_dir_perms; 7allow apexd apex_data_file:file create_file_perms; 8 9# Allow creating, reading and writing of APEX files/dirs in the APEX metadata dir 10allow apexd metadata_file:dir search; 11allow apexd apex_metadata_file:dir create_dir_perms; 12allow apexd apex_metadata_file:file create_file_perms; 13 14# allow apexd to create loop devices with /dev/loop-control 15allow apexd loop_control_device:chr_file rw_file_perms; 16# allow apexd to access loop devices 17allow apexd loop_device:blk_file rw_file_perms; 18allowxperm apexd loop_device:blk_file ioctl { 19 LOOP_GET_STATUS64 20 LOOP_SET_STATUS64 21 LOOP_SET_FD 22 LOOP_SET_BLOCK_SIZE 23 LOOP_SET_DIRECT_IO 24 LOOP_CLR_FD 25 BLKFLSBUF 26}; 27# allow apexd to access /dev/block 28allow apexd block_device:dir r_dir_perms; 29 30# allow apexd to access /dev/block/dm-* (device-mapper entries) 31allow apexd dm_device:chr_file rw_file_perms; 32allow apexd dm_device:blk_file rw_file_perms; 33 34# sys_admin is required to access the device-mapper and mount 35allow apexd self:global_capability_class_set sys_admin; 36 37# allow apexd to create a mount point in /apex 38allow apexd apex_mnt_dir:dir create_dir_perms; 39# allow apexd to mount in /apex 40allow apexd apex_mnt_dir:filesystem { mount unmount }; 41allow apexd apex_mnt_dir:dir mounton; 42# allow apexd to create symlinks in /apex 43allow apexd apex_mnt_dir:lnk_file create_file_perms; 44# allow apexd to unlink apex files in /data/apex/active 45# note that apexd won't be able to unlink files in /data/app-staging/session_XXXX, 46# because it doesn't have write permission for staging_data_file object. 47allow apexd staging_data_file:file unlink; 48 49# allow apexd to read files from /data/app-staging and hardlink them to /data/apex. 50allow apexd staging_data_file:dir r_dir_perms; 51allow apexd staging_data_file:file { r_file_perms link }; 52 53# Unmount and mount filesystems 54allow apexd labeledfs:filesystem { mount unmount }; 55 56# /sys directory tree traversal 57allow apexd sysfs_type:dir search; 58# Configure read-ahead of dm-verity and loop devices 59# for dm-X 60allow apexd sysfs_dm:dir r_dir_perms; 61allow apexd sysfs_dm:file rw_file_perms; 62# for loopX 63allow apexd sysfs_loop:dir r_dir_perms; 64allow apexd sysfs_loop:file rw_file_perms; 65 66# Spawning a libbinder thread results in a dac_override deny, 67# /dev/cpuset/tasks is owned by system. 68# 69# See b/35323867#comment3 70dontaudit apexd self:global_capability_class_set { dac_override dac_read_search }; 71 72# Allow apexd to log to the kernel. 73allow apexd kmsg_device:chr_file w_file_perms; 74 75# Allow apexd to reboot device. Required for rollbacks of apexes that are 76# not covered by rollback manager. 77set_prop(apexd, powerctl_prop) 78 79# Find the vold service, and call into vold to manage FS checkpoints 80allow apexd vold_service:service_manager find; 81binder_call(apexd, vold) 82 83# Apex pre- & post-install permission. 84 85# Allow self-execute for the fork mount helper. 86allow apexd apexd_exec:file execute_no_trans; 87 88# Unshare and make / private so that hooks cannot influence the 89# running system. 90allow apexd rootfs:dir mounton; 91 92# Allow to execute shell for pre- and postinstall scripts. A transition 93# rule is required, thus restricted to execute and not execute_no_trans. 94allow apexd shell_exec:file { r_file_perms execute }; 95 96# apexd is using bootstrap bionic 97allow apexd system_bootstrap_lib_file:dir r_dir_perms; 98allow apexd system_bootstrap_lib_file:file { execute read open getattr map }; 99 100# Allow transition to ART APEX preinstall domain. 101domain_auto_trans(apexd, art_apex_preinstall_exec, art_apex_preinstall) 102# Allow transition to ART APEX postinstall domain. 103domain_auto_trans(apexd, art_apex_postinstall_exec, art_apex_postinstall) 104 105# Allow transition to test APEX preinstall domain. 106userdebug_or_eng(` 107 domain_auto_trans(apexd, apex_test_prepostinstall_exec, apex_test_prepostinstall) 108') 109 110neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms; 111neverallow { domain -apexd -init } apex_metadata_file:dir no_w_dir_perms; 112neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms; 113neverallow { domain -apexd -init -kernel } apex_metadata_file:file no_w_file_perms; 114neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms; 115