1# snapuserd - Daemon for servicing dm-user requests for Virtual A/B snapshots. 2type snapuserd, domain; 3type snapuserd_exec, exec_type, file_type, system_file_type; 4 5typeattribute snapuserd coredomain; 6 7init_daemon_domain(snapuserd) 8 9allow snapuserd kmsg_device:chr_file rw_file_perms; 10 11allow snapuserd self:capability ipc_lock; 12 13# Allow snapuserd to reach block devices in /dev/block. 14allow snapuserd block_device:dir search; 15 16# Read /sys/block to find all the DM directories like (/sys/block/dm-X). 17allow snapuserd sysfs:dir { open read }; 18 19# Read /sys/block/dm-X/dm/name (which is a symlink to 20# /sys/devices/virtual/block/dm-X/dm/name) to identify the mapping between 21# dm-X and dynamic partitions. 22allow snapuserd sysfs_dm:dir { open read search }; 23allow snapuserd sysfs_dm:file r_file_perms; 24 25# Reading and writing to /dev/block/dm-* (device-mapper) nodes. 26allow snapuserd block_device:dir r_dir_perms; 27allow snapuserd dm_device:chr_file rw_file_perms; 28allow snapuserd dm_device:blk_file rw_file_perms; 29 30# Reading and writing to dm-user control nodes. 31allow snapuserd dm_user_device:dir r_dir_perms; 32allow snapuserd dm_user_device:chr_file rw_file_perms; 33 34# Reading and writing to /dev/socket/snapuserd and snapuserd_proxy. 35allow snapuserd snapuserd_socket:unix_stream_socket { accept listen getattr read write }; 36allow snapuserd snapuserd_proxy_socket:sock_file write; 37 38# This arises due to first-stage init opening /dev/null without F_CLOEXEC 39# (see SetStdioToDevNull in init). When we fork() and execveat() snapuserd 40# again, the descriptor leaks into the new process. 41allow snapuserd kernel:fd use; 42 43# snapuserd.* properties 44set_prop(snapuserd, snapuserd_prop) 45get_prop(snapuserd, virtual_ab_prop) 46 47# For inotify watching for /dev/socket/snapuserd_proxy to appear. 48allow snapuserd tmpfs:dir { read watch }; 49 50# Forbid anything other than snapuserd and init setting snapuserd properties. 51neverallow { 52 domain 53 -snapuserd 54 -init 55} snapuserd_prop:property_service set; 56