1# Any toolbox command run by init.
2# At present, the only known usage is for running mkswap via fs_mgr.
3# Do NOT use this domain for toolbox when run by any other domain.
4type toolbox, domain;
5type toolbox_exec, system_file_type, exec_type, file_type;
6
7# /dev/__null__ created by init prior to policy load,
8# open fd inherited by fsck.
9allow toolbox tmpfs:chr_file { read write ioctl };
10
11# Inherit and use pty created by android_fork_execvp_ext().
12allow toolbox devpts:chr_file { read write getattr ioctl };
13
14# mkswap-specific.
15# Read/write block devices used for swap partitions.
16# Assign swap_block_device type any such partition in your
17# device/<vendor>/<product>/sepolicy/file_contexts file.
18allow toolbox block_device:dir search;
19allow toolbox swap_block_device:blk_file rw_file_perms;
20
21# Only allow entry from init via the toolbox binary.
22neverallow { domain -init } toolbox:process transition;
23neverallow * toolbox:process dyntransition;
24neverallow toolbox { file_type fs_type -toolbox_exec}:file entrypoint;
25
26# rm -rf directories in /data
27allow toolbox system_data_root_file:dir { remove_name write };
28allow toolbox system_data_file:dir { rmdir rw_dir_perms };
29allow toolbox system_data_file:file { getattr unlink };
30
31# chattr +F and chattr +P /data/media in init
32allow toolbox media_rw_data_file:dir { r_dir_perms setattr };
33allowxperm toolbox media_rw_data_file:dir ioctl {
34  FS_IOC_FSGETXATTR
35  FS_IOC_FSSETXATTR
36  FS_IOC_GETFLAGS
37  FS_IOC_SETFLAGS
38};
39