Lines Matching full:vold
2 type vold, domain;
6 allow vold cache_file:dir r_dir_perms;
7 allow vold cache_file:file { getattr read };
8 allow vold cache_file:lnk_file r_file_perms;
11 r_dir_file(vold, proc_net)
12 r_dir_file(vold, sysfs_type)
14 allow vold sysfs:file w_file_perms; # writing to /sys/*/uevent during coldboot.
15 allow vold sysfs_dm:file w_file_perms;
16 allow vold sysfs_usb:file w_file_perms;
17 allow vold sysfs_zram_uevent:file w_file_perms;
19 r_dir_file(vold, rootfs)
20 r_dir_file(vold, metadata_file)
21 allow vold {
31 allow vold file_contexts_file:file r_file_perms;
34 allow vold self:process setexec;
37 allow vold shell_exec:file rx_file_perms;
40 allow vold e2fs_exec:file rx_file_perms;
42 typeattribute vold mlstrustedsubject;
43 allow vold self:process setfscreate;
44 allow vold system_file:file x_file_perms;
45 not_full_treble(`allow vold vendor_file:file x_file_perms;')
46 allow vold block_device:dir create_dir_perms;
47 allow vold device:dir write;
48 allow vold devpts:chr_file rw_file_perms;
49 allow vold rootfs:dir mounton;
50 allow vold sdcard_type:dir mounton; # TODO: deprecated in M
51 allow vold sdcard_type:filesystem { mount remount unmount }; # TODO: deprecated in M
52 allow vold sdcard_type:dir create_dir_perms; # TODO: deprecated in M
53 allow vold sdcard_type:file create_file_perms; # TODO: deprecated in M
56 allow vold { mnt_media_rw_file storage_file sdcard_type }:dir create_dir_perms;
57 allow vold { mnt_media_rw_file storage_file sdcard_type }:file create_file_perms;
60 allow vold media_rw_data_file:dir create_dir_perms;
61 allow vold media_rw_data_file:file create_file_perms;
64 allow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr …
67 allow vold mnt_user_file:dir create_dir_perms;
68 allow vold mnt_user_file:lnk_file create_file_perms;
71 allow vold mnt_expand_file:dir { create_dir_perms mounton };
72 allow vold apk_data_file:dir { create getattr setattr };
73 allow vold shell_data_file:dir { create getattr setattr };
75 allow vold tmpfs:filesystem { mount unmount };
76 allow vold tmpfs:dir create_dir_perms;
77 allow vold tmpfs:dir mounton;
78 allow vold self:global_capability_class_set { net_admin dac_override mknod sys_admin chown fowner f…
79 allow vold self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
80 allow vold app_data_file:dir search;
81 allow vold app_data_file:file rw_file_perms;
82 allow vold loop_control_device:chr_file rw_file_perms;
83 allow vold loop_device:blk_file { create setattr unlink rw_file_perms };
84 allow vold vold_device:blk_file { create setattr unlink rw_file_perms };
85 allow vold dm_device:chr_file rw_file_perms;
86 allow vold dm_device:blk_file rw_file_perms;
87 # For vold Process::killProcessesWithOpenFiles function.
88 allow vold domain:dir r_dir_perms;
89 allow vold domain:{ file lnk_file } r_file_perms;
90 allow vold domain:process { signal sigkill };
91 allow vold self:global_capability_class_set { sys_ptrace kill };
93 allow vold kmsg_device:chr_file rw_file_perms;
96 allow vold fsck_exec:file { r_file_perms execute };
99 allow vold fscklogs:dir rw_dir_perms;
100 allow vold fscklogs:file create_file_perms;
107 allow vold labeledfs:filesystem { mount unmount };
111 allow vold efs_file:file rw_file_perms;
114 allow vold system_data_file:dir { create rw_dir_perms mounton setattr rmdir };
115 allow vold system_data_file:lnk_file getattr;
117 # Vold create users in /data/vendor_{ce,de}/[0-9]+
118 allow vold vendor_data_file:dir create_dir_perms;
121 allow vold system_data_file:file read;
124 allow vold kernel:process setsched;
127 set_prop(vold, vold_prop)
128 set_prop(vold, exported_vold_prop)
129 set_prop(vold, exported2_vold_prop)
130 set_prop(vold, powerctl_prop)
131 set_prop(vold, ctl_fuse_prop)
132 set_prop(vold, restorecon_prop)
135 allow vold asec_image_file:file create_file_perms;
136 allow vold asec_image_file:dir rw_dir_perms;
137 allow vold asec_apk_file:dir { create_dir_perms mounton relabelfrom relabelto };
138 allow vold asec_public_file:dir { relabelto setattr };
139 allow vold asec_apk_file:file { r_file_perms setattr relabelfrom relabelto };
140 allow vold asec_public_file:file { relabelto setattr };
142 allow vold unlabeled:dir { r_dir_perms setattr relabelfrom };
143 allow vold unlabeled:file { r_file_perms setattr relabelfrom };
146 wakelock_use(vold)
148 # Allow vold to publish a binder service and make binder calls.
149 binder_use(vold)
150 add_service(vold, vold_service)
152 # Allow vold to call into the system server so it can check permissions.
153 binder_call(vold, system_server)
154 allow vold permission_service:service_manager find;
157 binder_call(vold, healthd)
160 hal_client_domain(vold, hal_keymaster)
163 allow vold userdata_block_device:blk_file rw_file_perms;
166 allow vold metadata_block_device:blk_file rw_file_perms;
168 # Allow vold to manipulate /data/unencrypted
169 allow vold unencrypted_data_file:{ file } create_file_perms;
170 allow vold unencrypted_data_file:dir create_dir_perms;
173 allow vold proc_drop_caches:file w_file_perms;
175 # Give vold a place where only vold can store files; everyone else is off limits
176 allow vold vold_data_file:dir create_dir_perms;
177 allow vold vold_data_file:file create_file_perms;
180 allow vold vold_metadata_file:dir create_dir_perms;
181 allow vold vold_metadata_file:file create_file_perms;
184 allow vold init:key { write search setattr };
185 allow vold vold:key { write search setattr };
187 # vold temporarily changes its priority when running benchmarks
188 allow vold self:global_capability_class_set sys_nice;
190 # vold needs to chroot into app namespaces to remount when runtime permissions change
191 allow vold self:global_capability_class_set sys_chroot;
192 allow vold storage_file:dir mounton;
195 allow vold fuse_device:chr_file rw_file_perms;
196 allow vold fuse:filesystem { relabelfrom };
197 allow vold app_fusefs:filesystem { relabelfrom relabelto };
198 allow vold app_fusefs:filesystem { mount unmount };
201 allow vold toolbox_exec:file rx_file_perms;
204 allow vold user_profile_data_file:dir create_dir_perms;
207 allow vold misc_block_device:blk_file w_file_perms;
211 -vold
218 -vold
226 -vold
232 -vold
239 -vold
248 -vold
252 neverallow { domain -vold -init } restorecon_prop:property_service set;
254 # Only system_server and vdc can interact with vold over binder
255 neverallow { domain -system_server -vdc -vold } vold_service:service_manager find;
256 neverallow vold {
266 neverallow vold fsck_exec:file execute_no_trans;
267 neverallow { domain -init } vold:process { transition dyntransition };
268 neverallow vold *:process ptrace;
269 neverallow vold *:rawip_socket *;