1# Any toolbox command run by init. 2# At present, the only known usage is for running mkswap via fs_mgr. 3# Do NOT use this domain for toolbox when run by any other domain. 4type toolbox, domain; 5type toolbox_exec, system_file_type, exec_type, file_type; 6 7# /dev/__null__ created by init prior to policy load, 8# open fd inherited by fsck. 9allow toolbox tmpfs:chr_file { read write ioctl }; 10 11# Inherit and use pty created by android_fork_execvp_ext(). 12allow toolbox devpts:chr_file { read write getattr ioctl }; 13 14# mkswap-specific. 15# Read/write block devices used for swap partitions. 16# Assign swap_block_device type any such partition in your 17# device/<vendor>/<product>/sepolicy/file_contexts file. 18allow toolbox block_device:dir search; 19allow toolbox swap_block_device:blk_file rw_file_perms; 20 21# Only allow entry from init via the toolbox binary. 22neverallow { domain -init } toolbox:process transition; 23neverallow * toolbox:process dyntransition; 24neverallow toolbox { file_type fs_type -toolbox_exec}:file entrypoint; 25 26# rm -rf directories in /data 27allow toolbox system_data_root_file:dir { remove_name write }; 28allow toolbox system_data_file:dir { rmdir rw_dir_perms }; 29allow toolbox system_data_file:file { getattr unlink }; 30 31# chattr +F and chattr +P /data/media in init 32allow toolbox media_rw_data_file:dir { r_dir_perms setattr }; 33allowxperm toolbox media_rw_data_file:dir ioctl { 34 FS_IOC_FSGETXATTR 35 FS_IOC_FSSETXATTR 36 FS_IOC_GETFLAGS 37 FS_IOC_SETFLAGS 38}; 39