1# volume manager 2type iorapd, domain; 3type iorapd_exec, exec_type, file_type, system_file_type; 4type iorapd_tmpfs, file_type; 5 6r_dir_file(iorapd, rootfs) 7 8# Allow read/write /proc/sys/vm/drop/caches 9allow iorapd proc_drop_caches:file rw_file_perms; 10 11# Give iorapd a place where only iorapd can store files; everyone else is off limits 12allow iorapd iorapd_data_file:dir create_dir_perms; 13allow iorapd iorapd_data_file:file create_file_perms; 14 15# Allow iorapd to publish a binder service and make binder calls. 16binder_use(iorapd) 17add_service(iorapd, iorapd_service) 18 19# Allow iorapd to call into the system server so it can check permissions. 20binder_call(iorapd, system_server) 21allow iorapd permission_service:service_manager find; 22# IUserManager 23allow iorapd user_service:service_manager find; 24# IPackageManagerNative 25allow iorapd package_native_service:service_manager find; 26# Allow dumpstate (bugreport) to call into iorapd. 27allow iorapd dumpstate:fd use; 28allow iorapd dumpstate:fifo_file write; 29 30# talk to batteryservice 31binder_call(iorapd, healthd) 32 33# TODO: does each of the service_manager allow finds above need the binder_call? 34 35# iorapd temporarily changes its priority when running benchmarks 36allow iorapd self:global_capability_class_set sys_nice; 37 38# Allow to access Perfetto traced's privileged consumer socket to start/stop 39# tracing sessions and read trace data. 40unix_socket_connect(iorapd, traced_consumer, traced) 41 42# Allow iorapd to execute compilation (iorap.cmd.compiler) in idle time. 43allow iorapd system_file:file rx_file_perms; 44 45# Allow iorapd to send signull to iorap_inode2filename and iorap_prefetcherd. 46allow iorapd iorap_inode2filename:process signull; 47allow iorapd iorap_prefetcherd:process signull; 48 49# Allowing system_server to check for the existence and size of files under iorapd 50# dir without collecting any sensitive app data. 51# This is used to predict if iorapd is doing prefetching or not. 52allow system_server iorapd_data_file:dir { getattr open read search }; 53allow system_server iorapd_data_file:file getattr; 54 55### 56### neverallow rules 57### 58 59neverallow { 60 domain 61 -iorapd 62} iorapd_data_file:dir ~{ open create read getattr setattr search relabelto ioctl }; 63 64neverallow { 65 domain 66 -init 67 -iorapd 68 -system_server 69} iorapd_data_file:dir *; 70 71neverallow { 72 domain 73 -kernel 74 -iorapd 75} iorapd_data_file:notdevfile_class_set ~{ relabelto getattr }; 76 77neverallow { 78 domain 79 -init 80 -kernel 81 -vendor_init 82 -iorapd 83 -system_server 84} { iorapd_data_file }:notdevfile_class_set *; 85 86# Only system_server and shell (for dumpsys) can interact with iorapd over binder 87neverallow { domain -dumpstate -system_server -iorapd } iorapd_service:service_manager find; 88neverallow iorapd { 89 domain 90 -healthd 91 -servicemanager 92 -system_server 93 userdebug_or_eng(`-su') 94}:binder call; 95 96neverallow { domain -init } iorapd:process { transition dyntransition }; 97neverallow iorapd domain:{ tcp_socket udp_socket rawip_socket } *; 98