1# Fuseblk is a Filesystem in USErspace for block device. It should only be used 2# to mount untrusted blocks like USB drives. 3type fuseblkd_untrusted_exec, system_file_type, exec_type, file_type; 4type fuseblkd_untrusted, domain; 5 6typeattribute fuseblkd_untrusted coredomain; 7 8domain_auto_trans(fuseblkd_untrusted, fuseblkd_exec, fuseblkd); 9 10# Allow stdin/out back to vold. 11allow fuseblkd_untrusted vold:fd use; 12 13# Allows fuseblk to read block devices. 14allow fuseblkd_untrusted block_device:dir search; 15 16# Permissions to read dynamic partitions blocks. 17allow fuseblkd_untrusted super_block_device:blk_file getattr; 18 19# Permissions to access FUSE character devices. 20allow fuseblkd_untrusted fuse_device:chr_file { getattr open read write }; 21 22# Permissions to access /mnt/media_rw/. 23allow fuseblkd_untrusted mnt_media_rw_file:dir { getattr search }; 24allow fuseblkd_untrusted mnt_media_rw_stub_file:dir getattr; 25 26# Permissions to read device mappers. 27allow fuseblkd_untrusted sysfs_dm:dir search; 28allow fuseblkd_untrusted sysfs_dm:file { getattr open read }; 29allow fuseblkd_untrusted dm_device:blk_file getattr; 30 31# Permissions to read links in tmpfs. 32allow fuseblkd_untrusted tmpfs:lnk_file read; 33 34# Permissions to read loop device blocks. 35allow fuseblkd_untrusted loop_device:blk_file getattr; 36 37# Permissions to access the /proc/filesystems file. 38allow fuseblkd_untrusted proc_filesystems:file { open read getattr }; 39 40### 41### dontaudit rules 42### 43 44# ntfs-3g wants this permission to read a fork return code, for some reason. 45# It's unclear why, because it still reads the fork return code correctly, 46# and nothing breaks. If enforce is set to permissive, the audit goes away. 47dontaudit fuseblkd_untrusted self:capability sys_admin; 48 49### 50### neverallow rules 51### 52 53# Fuseblk should never be run on block devices holding sensitive data. 54neverallow fuseblkd_untrusted { 55 boot_block_device 56 frp_block_device 57 metadata_block_device 58 recovery_block_device 59 root_block_device 60 swap_block_device 61 system_block_device 62 userdata_block_device 63 cache_block_device 64 dm_device 65}:blk_file no_rw_file_perms; 66 67# Only allow entry from vold, and only through fuseblkd_untrusted_exec binaries. 68neverallow { domain -vold } fuseblkd_untrusted:process transition; 69neverallow * fuseblkd_untrusted:process dyntransition; 70neverallow fuseblkd_untrusted { file_type fs_type -fuseblkd_untrusted_exec }:file entrypoint; 71 72# Under no circumstances should fuseblkd_untrusted or any other fuseblk filesystem be 73# given sys_admin access. They are fundementally untrusted, insecure filesystems. 74# The correct solution here is to compartmentalize permissions correctly so that 75# a smaller binary can get the required permissions. See fuseblkd.te. 76# Similar to above, we don't need setgid or setuid permissions. 77neverallow fuseblkd_untrusted self:capability { setgid setuid sys_admin }; 78neverallow fuseblkd_untrusted self:global_capability_class_set { setgid setuid sys_admin }; 79 80# Since we can't have sys_admin permissions, we definitely can't have mount/unmount 81# permissions, since we won't be able to use them. Same with relabel permissions. 82neverallow fuseblkd_untrusted fuseblk:filesystem { mount unmount relabelto relabelfrom}; 83