1# snapuserd - Daemon for servicing dm-user requests for Virtual A/B snapshots. 2type snapuserd, domain; 3type snapuserd_exec, exec_type, file_type, system_file_type; 4 5typeattribute snapuserd coredomain; 6 7init_daemon_domain(snapuserd) 8 9allow snapuserd kmsg_device:chr_file rw_file_perms; 10 11# Reading and writing to /dev/block/dm-* (device-mapper) nodes. 12allow snapuserd block_device:dir r_dir_perms; 13allow snapuserd dm_device:chr_file rw_file_perms; 14allow snapuserd dm_device:blk_file rw_file_perms; 15 16# Reading and writing to dm-user control nodes. 17allow snapuserd dm_user_device:dir r_dir_perms; 18allow snapuserd dm_user_device:chr_file rw_file_perms; 19 20# Reading and writing to /dev/socket/snapuserd. 21allow snapuserd snapuserd_socket:unix_stream_socket { accept listen getattr read write }; 22 23# This arises due to first-stage init opening /dev/null without F_CLOEXEC 24# (see SetStdioToDevNull in init). When we fork() and execveat() snapuserd 25# again, the descriptor leaks into the new process. 26allow snapuserd kernel:fd use; 27