Lines Matching refs:snapuserd

1 # snapuserd - Daemon for servicing dm-user requests for Virtual A/B snapshots.
2 type snapuserd, domain;
5 typeattribute snapuserd coredomain;
7 init_daemon_domain(snapuserd)
9 allow snapuserd kmsg_device:chr_file rw_file_perms;
11 # Allow snapuserd to reach block devices in /dev/block.
12 allow snapuserd block_device:dir search;
15 allow snapuserd sysfs:dir { open read };
20 allow snapuserd sysfs_dm:dir { open read search };
21 allow snapuserd sysfs_dm:file r_file_perms;
24 allow snapuserd block_device:dir r_dir_perms;
25 allow snapuserd dm_device:chr_file rw_file_perms;
26 allow snapuserd dm_device:blk_file rw_file_perms;
29 allow snapuserd dm_user_device:dir r_dir_perms;
30 allow snapuserd dm_user_device:chr_file rw_file_perms;
32 # Reading and writing to /dev/socket/snapuserd and snapuserd_proxy.
33 allow snapuserd snapuserd_socket:unix_stream_socket { accept listen getattr read write };
34 allow snapuserd snapuserd_proxy_socket:sock_file write;
37 # (see SetStdioToDevNull in init). When we fork() and execveat() snapuserd
39 allow snapuserd kernel:fd use;
41 # snapuserd.* properties
42 set_prop(snapuserd, snapuserd_prop)
43 get_prop(snapuserd, virtual_ab_prop)
46 allow snapuserd tmpfs:dir { read watch };
48 # Forbid anything other than snapuserd and init setting snapuserd properties.
51   -snapuserd
56 allow snapuserd metadata_file:dir search;
57 allow snapuserd ota_metadata_file:dir rw_dir_perms;
58 allow snapuserd ota_metadata_file:file create_file_perms;
60 # This capability allows snapuserd to circumvent memlock rlimits while using
61 # io_uring. An Alternative would be to up the memlock rlimit for the snapuserd service.
62 allow snapuserd self:capability ipc_lock;
63 io_uring_use(snapuserd)