1type dlkm_loader, domain; 2type dlkm_loader_exec, exec_type, vendor_file_type, file_type; 3 4init_daemon_domain(dlkm_loader) 5 6# Allow insmod on vendor, system and system_dlkm partitions 7allow dlkm_loader self:capability sys_module; 8allow dlkm_loader system_dlkm_file:dir r_dir_perms; 9allow dlkm_loader system_dlkm_file:file r_file_perms; 10allow dlkm_loader system_dlkm_file:system module_load; 11allow dlkm_loader system_file:system module_load; 12allow dlkm_loader vendor_file:system module_load; 13 14# needed for libmodprobe to read kernel commandline 15allow dlkm_loader proc_cmdline:file r_file_perms; 16 17# Needed because CONFIG_USB_DUMMY_HCD adds some additional logic to 18# finit_module() syscall, causing that syscall to create/update keyrings. 19# Once we remove CONFIG_USB_DUMMY_HCD config, self:key write permission can be 20# removed. 21allow dlkm_loader self:key write; 22 23# Allow writing to kernel log 24allow dlkm_loader kmsg_device:chr_file rw_file_perms; 25 26# dlkm_loader searches tracefs while looking for modules 27dontaudit dlkm_loader debugfs_bootreceiver_tracing:dir search; 28dontaudit dlkm_loader debugfs_mm_events_tracing:dir search; 29 30set_prop(dlkm_loader, vendor_dlkm_prop) 31