Lines Matching refs:vold

2 type vold, domain;
6 allow vold cache_file:dir r_dir_perms;
7 allow vold cache_file:file { getattr read };
8 allow vold cache_file:lnk_file r_file_perms;
10 r_dir_file(vold, { sysfs_type -sysfs_batteryinfo })
12 allow vold {
22 r_dir_file(vold, rootfs)
23 r_dir_file(vold, metadata_file)
24 allow vold {
35 allow vold file_contexts_file:file r_file_perms;
38 allow vold self:process setexec;
41 allow vold e2fs_exec:file rx_file_perms;
45 allowxperm vold { fs_type file_type }:dir ioctl FITRIM;
49 allowxperm vold data_file_type:dir ioctl {
56 # Only vold and init should ever set file-based encryption policies.
59   -vold
64 # Only vold should ever add/remove file-based encryption keys.
67   -vold
73 allowxperm vold {
81 typeattribute vold mlstrustedsubject;
82 allow vold self:process setfscreate;
83 allow vold system_file:file x_file_perms;
84 not_full_treble(`allow vold vendor_file:file x_file_perms;')
85 allow vold block_device:dir create_dir_perms;
86 allow vold device:dir write;
87 allow vold devpts:chr_file rw_file_perms;
88 allow vold rootfs:dir mounton;
89 allow vold sdcard_type:dir mounton; # TODO: deprecated in M
90 allow vold sdcard_type:filesystem { mount remount unmount }; # TODO: deprecated in M
91 allow vold sdcard_type:dir create_dir_perms; # TODO: deprecated in M
92 allow vold sdcard_type:file create_file_perms; # TODO: deprecated in M
95 allow vold { mnt_media_rw_file storage_file sdcard_type }:dir create_dir_perms;
96 allow vold { mnt_media_rw_file storage_file sdcard_type }:file create_file_perms;
99 allow vold media_rw_data_file:dir create_dir_perms;
100 allow vold media_rw_data_file:file create_file_perms;
102 allow vold media_rw_data_file:dir mounton;
106 allowxperm vold media_rw_data_file:{ dir file } ioctl {
114 allow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr …
117 allow vold mnt_user_file:dir { create_dir_perms mounton };
118 allow vold mnt_user_file:lnk_file create_file_perms;
119 allow vold mnt_user_file:file create_file_perms;
122 allow vold mnt_pass_through_file:dir { create_dir_perms mounton };
123 allow vold mnt_pass_through_file:lnk_file create_file_perms;
126 allow vold mnt_expand_file:dir { create_dir_perms mounton };
127 allow vold apk_data_file:dir { create getattr setattr };
128 allow vold shell_data_file:dir { create getattr setattr };
131 allow vold apk_data_file:dir { mounton rw_dir_perms };
133 allow vold apk_data_file:file { rw_file_perms unlink };
135 allow vold apk_tmp_file:dir { mounton r_dir_perms };
137 allow vold incremental_control_file:file { r_file_perms relabelto };
139 allow vold tmpfs:filesystem { mount unmount };
140 allow vold tmpfs:dir create_dir_perms;
141 allow vold tmpfs:dir mounton;
142 allow vold self:global_capability_class_set { net_admin dac_override dac_read_search mknod sys_admi…
143 allow vold self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
144 allow vold loop_control_device:chr_file rw_file_perms;
145 allow vold loop_device:blk_file { create setattr unlink rw_file_perms };
146 allowxperm vold loop_device:blk_file ioctl {
153 allow vold vold_device:blk_file { create setattr unlink rw_file_perms };
154 allowxperm vold vold_device:blk_file ioctl { BLKDISCARD BLKGETSIZE };
155 allow vold dm_device:chr_file rw_file_perms;
156 allow vold dm_device:blk_file rw_file_perms;
157 allowxperm vold dm_device:blk_file ioctl { BLKDISCARD BLKSECDISCARD };
158 # For vold Process::killProcessesWithOpenFiles function.
159 allow vold domain:dir r_dir_perms;
160 allow vold domain:{ file lnk_file } r_file_perms;
161 allow vold domain:process { signal sigkill };
162 allow vold self:global_capability_class_set { sys_ptrace kill };
164 allow vold kmsg_device:chr_file rw_file_perms;
167 allow vold fsck_exec:file { r_file_perms execute };
170 allow vold fscklogs:dir rw_dir_perms;
171 allow vold fscklogs:file create_file_perms;
178 allow vold labeledfs:filesystem { mount unmount remount };
182 allow vold efs_file:file rw_file_perms;
185 allow vold {
189 allow vold system_data_file:lnk_file getattr;
192 allow vold vendor_data_file:dir create_dir_perms;
195 allow vold system_data_file:file read;
198 allow vold kernel:process setsched;
201 allow vold asec_image_file:file create_file_perms;
202 allow vold asec_image_file:dir rw_dir_perms;
203 allow vold asec_apk_file:dir { create_dir_perms mounton relabelfrom relabelto };
204 allow vold asec_public_file:dir { relabelto setattr };
205 allow vold asec_apk_file:file { r_file_perms setattr relabelfrom relabelto };
206 allow vold asec_public_file:file { relabelto setattr };
208 allow vold unlabeled:dir { r_dir_perms setattr relabelfrom };
209 allow vold unlabeled:file { r_file_perms setattr relabelfrom };
212 allow vold fusectlfs:file rw_file_perms;
213 allow vold fusectlfs:dir rw_dir_perms;
216 wakelock_use(vold)
218 # Allow vold to publish a binder service and make binder calls.
219 binder_use(vold)
220 add_service(vold, vold_service)
222 # Allow vold to call into the system server so it can check permissions.
223 binder_call(vold, system_server)
224 allow vold permission_service:service_manager find;
227 binder_call(vold, healthd)
230 hal_client_domain(vold, hal_keymaster)
233 hal_client_domain(vold, hal_health_storage)
236 full_treble_only(`hal_client_domain(vold, hal_bootctl)')
239 allow vold userdata_block_device:blk_file rw_file_perms;
240 allowxperm vold userdata_block_device:blk_file ioctl BLKSECDISCARD;
243 allow vold metadata_block_device:blk_file rw_file_perms;
244 allowxperm vold metadata_block_device:blk_file ioctl BLKSECDISCARD;
246 # Allow vold to manipulate /data/unencrypted
247 allow vold unencrypted_data_file:{ file } create_file_perms;
248 allow vold unencrypted_data_file:dir create_dir_perms;
251 allow vold proc_drop_caches:file w_file_perms;
253 # Give vold a place where only vold can store files; everyone else is off limits
254 allow vold vold_data_file:dir create_dir_perms;
255 allow vold vold_data_file:file create_file_perms;
258 allow vold vold_metadata_file:dir create_dir_perms;
259 allow vold vold_metadata_file:file create_file_perms;
262 allow vold init:key { write search setattr };
263 allow vold vold:key { write search setattr };
265 # vold temporarily changes its priority when running benchmarks
266 allow vold self:global_capability_class_set sys_nice;
268 # vold needs to chroot into app namespaces to remount when runtime permissions change
269 allow vold self:global_capability_class_set sys_chroot;
270 allow vold storage_file:dir mounton;
273 allow vold fuse_device:chr_file rw_file_perms;
274 allow vold fuse:filesystem { relabelfrom };
275 allow vold app_fusefs:filesystem { relabelfrom relabelto };
276 allow vold app_fusefs:filesystem { mount unmount };
277 allow vold app_fuse_file:dir rw_dir_perms;
278 allow vold app_fuse_file:file { read write open getattr append };
281 allow vold toolbox_exec:file rx_file_perms;
284 allow vold { user_profile_data_file user_profile_root_file }:dir create_dir_perms;
287 allow vold misc_block_device:blk_file w_file_perms;
289 # vold might need to search or mount /mnt/vendor/*
290 allow vold mnt_vendor_file:dir search;
292 dontaudit vold self:global_capability_class_set sys_resource;
295 read_fstab(vold)
297 # vold might need to search loopback apex files
298 allow vold vendor_apex_file:file r_file_perms;
302     -vold
309     -vold
316     -vold
322     -vold
329     -vold
337     -vold
341 neverallow { domain -vold -init } restorecon_prop:property_service set;
343 neverallow vold {
358 neverallow vold fsck_exec:file execute_no_trans;
359 neverallow { domain -init } vold:process { transition dyntransition };
360 neverallow vold *:process ptrace;
361 neverallow vold *:rawip_socket *;