1# /proc/allocinfo 2type proc_allocinfo, fs_type, proc_type; 3 4# /proc/config.gz 5type config_gz, fs_type, proc_type; 6 7# /sys/fs/bpf/<dir> for mainline tethering use 8# TODO: move S+ fs_bpf_tethering here from public/file.te 9type fs_bpf_net_private, fs_type, bpffs_type; 10type fs_bpf_net_shared, fs_type, bpffs_type; 11type fs_bpf_netd_readonly, fs_type, bpffs_type; 12type fs_bpf_netd_shared, fs_type, bpffs_type; 13type fs_bpf_loader, fs_type, bpffs_type; 14type fs_bpf_uprobestats, fs_type, bpffs_type; 15type fs_bpf_memevents, fs_type, bpffs_type; 16 17# /data/misc/storaged 18type storaged_data_file, file_type, data_file_type, core_data_file_type; 19 20# /data/misc/wmtrace for wm traces 21type wm_trace_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 22 23# /data/misc/a11ytrace for accessibility traces 24type accessibility_trace_data_file, file_type, data_file_type, core_data_file_type; 25 26# /data/misc/perfetto-traces for perfetto traces 27type perfetto_traces_data_file, file_type, data_file_type, core_data_file_type; 28 29# /data/misc/perfetto-traces/bugreport for perfetto traces for bugreports. 30type perfetto_traces_bugreport_data_file, file_type, data_file_type, core_data_file_type; 31 32# /data/misc/perfetto-traces/profiling for perfetto traces from profiling apis. 33type perfetto_traces_profiling_data_file, file_type, data_file_type, core_data_file_type; 34 35# /data/misc/perfetto-configs for perfetto configs 36type perfetto_configs_data_file, file_type, data_file_type, core_data_file_type; 37 38# /system/etc/perfetto for perfetto configs 39type system_perfetto_config_file, file_type, system_file_type; 40 41# /data/misc/uprobestats-configs for uprobestats configs 42type uprobestats_configs_data_file, file_type, data_file_type, core_data_file_type; 43 44# /apex/com.android.art/bin/oatdump 45# TODO (b/350628688): Remove this once it's safe to do so. 46type oatdump_exec, system_file_type, exec_type, file_type; 47 48# /data/misc_{ce/de}/<user>/sdksandbox root data directory for sdk sandbox processes 49type sdk_sandbox_system_data_file, file_type, data_file_type, core_data_file_type; 50# /data/misc_{ce/de}/<user>/sdksandbox/<app-name>/* subdirectory for sdk sandbox processes 51type sdk_sandbox_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type; 52 53# /sys/kernel/debug/kcov for coverage guided kernel fuzzing in userdebug builds. 54type debugfs_kcov, fs_type, debugfs_type; 55 56# App executable files in /data/data directories 57type app_exec_data_file, file_type, data_file_type, core_data_file_type; 58typealias app_exec_data_file alias rs_data_file; 59 60# /data/misc_[ce|de]/rollback : Used by installd to store snapshots 61# of application data. 62type rollback_data_file, file_type, data_file_type, core_data_file_type; 63 64# /data/misc_ce/checkin for checkin apps. 65type checkin_data_file, file_type, data_file_type, core_data_file_type; 66 67# /data/gsi/ota 68type ota_image_data_file, file_type, data_file_type, core_data_file_type; 69 70# /data/gsi_persistent_data 71type gsi_persistent_data_file, file_type, data_file_type, core_data_file_type; 72 73# /data/misc/emergencynumberdb 74type emergency_data_file, file_type, data_file_type, core_data_file_type; 75 76# /data/misc/profcollectd 77type profcollectd_data_file, file_type, data_file_type, core_data_file_type; 78 79# /data/misc/apexdata/com.android.art 80type apex_art_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type; 81 82# /data/misc/apexdata/com.android.art/staging 83type apex_art_staging_data_file, file_type, data_file_type, core_data_file_type; 84 85# /data/misc/apexdata/com.android.compos 86type apex_compos_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type; 87 88# /data/misc/apexdata/com.android.virt 89type apex_virt_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type; 90 91# /data/misc/apexdata/com.android.tethering 92type apex_tethering_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type; 93 94# /data/misc/apexdata/com.android.uwb 95type apex_uwb_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type; 96 97# legacy labels for various /data/misc[_ce|_de]/*/apexdata directories - retained 98# for backward compatibility b/217581286 99type apex_appsearch_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type; 100type apex_permission_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type; 101type apex_scheduling_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type; 102type apex_wifi_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type; 103 104# /data/font/files 105type font_data_file, file_type, data_file_type, core_data_file_type; 106 107# /data/misc/dmesgd 108type dmesgd_data_file, file_type, data_file_type, core_data_file_type; 109 110# /data/misc/odrefresh 111type odrefresh_data_file, file_type, data_file_type, core_data_file_type; 112 113# /data/misc/odsign 114type odsign_data_file, file_type, data_file_type, core_data_file_type; 115 116# /data/misc/odsign_metrics 117type odsign_metrics_file, file_type, data_file_type, core_data_file_type; 118 119# /data/misc/virtualizationservice 120# The type needs to be mlstrustedobject to allow for being accessed from 121# virtualizationmanager, which runs at a more constrained MLS level. 122type virtualizationservice_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject; 123 124# /mnt/vm 125type vm_data_file, file_type, core_data_file_type; 126 127# /data/system/environ 128type environ_system_data_file, file_type, data_file_type, core_data_file_type; 129 130# /data/misc/bootanim 131type bootanim_data_file, file_type, data_file_type, core_data_file_type; 132 133# /dev/kvm 134# The type needs to be mlstrustedobject to allow for being accessed from 135# crosvm, which runs at a more constrained MLS level. 136type kvm_device, dev_type, mlstrustedobject, vm_manager_device_type; 137 138# /apex/com.android.virt/bin/fd_server 139type fd_server_exec, system_file_type, exec_type, file_type; 140 141# /apex/com.android.compos/bin/compsvc 142type compos_exec, exec_type, file_type, system_file_type; 143# /apex/com.android.compos/bin/compos_key_helper 144type compos_key_helper_exec, exec_type, file_type, system_file_type; 145 146# Filesystem entry for for PRNG seeder socket. Processes require 147# write permission on this to connect, and needs to be mlstrustedobject 148# in to satisfy MLS constraints for trusted domains. 149type prng_seeder_socket, file_type, coredomain_socket, mlstrustedobject; 150 151# /proc/device-tree/avf and /sys/firmware/devicetree/base/avf 152type sysfs_dt_avf, fs_type, sysfs_type; 153type proc_dt_avf, fs_type, proc_type; 154 155# Type for /system/fonts/font_fallback.xm 156type system_font_fallback_file, system_file_type, file_type; 157 158# Type for /sys/devices/uprobe. 159type sysfs_uprobe, fs_type, sysfs_type; 160 161# Type for aconfig daemon socket 162type aconfigd_socket, file_type, coredomain_socket, mlstrustedobject; 163 164# Type for aconfig mainline daemon socket 165type aconfigd_mainline_socket, file_type, coredomain_socket, mlstrustedobject; 166 167# Type for /(system|system_ext|product)/etc/aconfig 168type system_aconfig_storage_file, system_file_type, file_type; 169 170# Type for /vendor/etc/aconfig 171type vendor_aconfig_storage_file, vendor_file_type, file_type; 172 173# /data/misc/connectivityblobdb 174type connectivityblob_data_file, file_type, data_file_type, core_data_file_type; 175 176# /data/misc/wifi/mainline_supplicant 177type mainline_supplicant_data_file, file_type, data_file_type, core_data_file_type; 178 179# Type for /mnt/pre_reboot_dexopt 180type pre_reboot_dexopt_file, file_type; 181 182# Type for /mnt/artd_tmp in the Pre-reboot Dexopt chroot 183# This type is set on the directory through the `rootcontext=` mount option. 184type pre_reboot_dexopt_artd_file, file_type; 185 186# /data/app-metadata - extracted app metadata bundles from APKs 187type apk_metadata_file, file_type, data_file_type, core_data_file_type; 188 189# Type for /sys/kernel/mm/pgsize_migration/enabled 190type sysfs_pgsize_migration, fs_type, sysfs_type; 191 192# /sys/firmware/acpi/tables 193type sysfs_firmware_acpi_tables, fs_type, sysfs_type; 194 195# Type for /system/bin/pbtombstone. 196type pbtombstone_exec, system_file_type, exec_type, file_type; 197 198# Allow files to be created in their appropriate filesystems. 199allow fs_type self:filesystem associate; 200allow cgroup tmpfs:filesystem associate; 201allow cgroup_v2 tmpfs:filesystem associate; 202allow cgroup_rc_file tmpfs:filesystem associate; 203allow sysfs_type sysfs:filesystem associate; 204allow debugfs_type { debugfs debugfs_tracing debugfs_tracing_debug }:filesystem associate; 205allow file_type labeledfs:filesystem associate; 206allow file_type tmpfs:filesystem associate; 207allow file_type rootfs:filesystem associate; 208allow dev_type tmpfs:filesystem associate; 209allow app_fuse_file app_fusefs:filesystem associate; 210allow postinstall_file self:filesystem associate; 211allow proc_net proc:filesystem associate; 212 213# It's a bug to assign the file_type attribute and fs_type attribute 214# to any type. Do not allow it. 215# 216# For example, the following is a bug: 217# type apk_data_file, file_type, data_file_type, fs_type; 218# Should be: 219# type apk_data_file, file_type, data_file_type; 220neverallow fs_type file_type:filesystem associate; 221# app directories of storage areas: /data/storage_area/userId/pkgName -- apps cannot write to it 222type storage_area_app_dir, file_type, data_file_type, core_data_file_type, app_data_file_type; 223# app storage areas: /data/storage_area/userId/pkgName/storageAreaName 224type storage_area_dir, file_type, data_file_type, core_data_file_type, app_data_file_type; 225# contents of app storage areas: /data/storage_area/userId/pkgName/storageAreaName/* 226type storage_area_content_file, file_type, data_file_type, core_data_file_type, app_data_file_type; 227 228# /data/misc_ce/userId/storage_area_keys 229type storage_area_key_file, file_type, data_file_type, core_data_file_type; 230 231# /metadata/tradeinmode files 232type tradeinmode_metadata_file, file_type; 233 234# /metadata/prefetch files 235type prefetch_metadata_file, file_type; 236 237# /metadata/libprocessgroup files 238type libprocessgroup_metadata_file, file_type; 239 240# Types added in 202504 in public/file.te 241until_board_api(202504, ` 242 type binderfs_logs_transactions, fs_type; 243 type binderfs_logs_transaction_history, fs_type; 244') 245 246until_board_api(202504, ` 247 type proc_cgroups, fs_type, proc_type; 248') 249 250until_board_api(202504, ` 251 type sysfs_udc, fs_type, sysfs_type; 252') 253 254until_board_api(202504, ` 255 type fs_bpf_lmkd_memevents_rb, fs_type, bpffs_type; 256 type fs_bpf_lmkd_memevents_prog, fs_type, bpffs_type; 257') 258 259until_board_api(202504, ` 260 # boot otas for 16KB developer option 261 type vendor_boot_ota_file, vendor_file_type, file_type; 262') 263 264until_board_api(202504, ` 265 type tee_service_contexts_file, system_file_type, file_type; 266') 267 268until_board_api(202504, ` 269 type sysfs_mem_sleep, fs_type, sysfs_type; 270') 271 272## END Types added in 202504 in public/file.te 273