Lines Matching refs:init

1 # init is its own domain.
2 type init, domain, mlstrustedsubject;
4 # The init domain is entered by execing init.
7 # /dev/__null__ node created by init.
8 allow init tmpfs:chr_file { create setattr unlink rw_file_perms };
11 # init direct restorecon calls.
14 allow init tmpfs:chr_file relabelfrom;
15 allow init kmsg_device:chr_file { write relabelto };
18   allow init kmsg_debug_device:chr_file { write relabelto };
21 allow init properties_device:dir relabelto;
22 allow init properties_serial:file { write relabelto };
23 allow init property_type:file { create_file_perms relabelto };
25 allow init device:file relabelfrom;
26 allow init runtime_event_log_tags_file:file { open write setattr relabelto };
28 allow init { device socket_device }:dir relabelto;
30 allow init random_device:chr_file relabelto;
32 allow init tmpfs:{ chr_file blk_file } relabelfrom;
33 allow init tmpfs:blk_file getattr;
34 allow init block_device:{ dir blk_file lnk_file } relabelto;
35 allow init dm_device:{ chr_file blk_file } relabelto;
36 allow init kernel:fd use;
38 allow init tmpfs:lnk_file { getattr read relabelfrom };
39 allow init system_block_device:{ blk_file lnk_file } relabelto;
42 allow init self:capability sys_resource;
45 allow init tmpfs:file unlink;
48 allow init devpts:chr_file { read write open };
51 allow init fscklogs:file create_file_perms;
54 allow init tmpfs:chr_file write;
57 allow init console_device:chr_file rw_file_perms;
60 allow init tty_device:chr_file rw_file_perms;
63 allow init self:capability sys_admin;
66 allow init rootfs:dir create_dir_perms;
67 allow init { rootfs cache_file cgroup storage_file system_data_file system_file vendor_file postins…
70 allow init device:dir mounton;
73 allow init rootfs:lnk_file { create unlink };
76 allow init sysfs:dir mounton;
79 allow init tmpfs:dir create_dir_perms;
80 allow init tmpfs:dir mounton;
81 allow init cgroup:dir create_dir_perms;
82 r_dir_file(init, cgroup)
83 allow init cpuctl_device:dir { create mounton };
86 allow init configfs:dir mounton;
87 allow init configfs:dir create_dir_perms;
88 allow init configfs:{ file lnk_file } create_file_perms;
91 allow init tmpfs:dir relabelfrom;
94 allow init self:capability dac_override;
97 allow init self:capability sys_time;
99 allow init self:capability { sys_rawio mknod };
102 allow init dev_type:blk_file r_file_perms;
109 allow init fs_type:filesystem ~relabelto;
110 allow init unlabeled:filesystem ~relabelto;
111 allow init contextmount_type:filesystem relabelto;
114 allow init contextmount_type:dir r_dir_perms;
115 allow init contextmount_type:notdevfile_class_set r_file_perms;
119 allow init rootfs:{ dir file } relabelfrom;
121 # mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files.
123 # system/core/init.rc requires at least cache_file and data_file_type.
124 # init.<board>.rc files often include device-specific types, so
126 allow init self:capability { chown fowner fsetid };
128 allow init {
138 allow init {
151 allow init {
165 allow init {
178 allow init {
191 allow init cache_file:lnk_file r_file_perms;
193 allow init { file_type -system_file -vendor_file_type -exec_type }:dir_file_class_set relabelto;
194 allow init { sysfs debugfs debugfs_tracing }:{ dir file lnk_file } { getattr relabelfrom };
195 allow init { sysfs_type debugfs_type }:{ dir file lnk_file } { relabelto getattr };
196 allow init dev_type:dir create_dir_perms;
197 allow init dev_type:lnk_file create;
200 allow init debugfs_tracing:file w_file_perms;
203 allow init debugfs_tracing_instances:dir create_dir_perms;
204 allow init debugfs_tracing_instances:file w_file_perms;
205 allow init debugfs_wifi_tracing:file w_file_perms;
208 allow init { fs_type -contextmount_type -sdcard_type -rootfs }:file { open read setattr };
209 allow init { fs_type -contextmount_type -sdcard_type -rootfs }:dir  { open read setattr search };
211 # init should not be able to read or open generic devices
213 allow init {
220 auditallow init {
243 allow init { dev_type -kmem_device -port_device }:chr_file setattr;
246 allow init unlabeled:dir { create_dir_perms relabelfrom };
247 allow init unlabeled:notdevfile_class_set { create_file_perms relabelfrom };
251 allow init kernel:system syslog_mod;
252 allow init self:capability2 syslog;
255 allow init { usermodehelper sysfs_usermodehelper }:file rw_file_perms;
256 allow init proc_security:file rw_file_perms;
259 r_dir_file(init, proc)
260 allow init proc:file w_file_perms;
263 r_dir_file(init, proc_net)
264 allow init proc_net:file w_file_perms;
265 allow init self:capability net_admin;
268 allow init proc_sysrq:file w_file_perms;
271 allow init proc_stat:file r_file_perms;
274 allow init self:capability sys_boot;
277 allow init sysfs_type:dir r_dir_perms;
278 allow init sysfs_type:lnk_file read;
279 allow init sysfs_type:file rw_file_perms;
283 allow init misc_logd_file:dir { add_name open create read getattr setattr search write };
284 allow init misc_logd_file:file { open create getattr setattr write };
287 allow init self:capability kill;
288 allow init domain:process { getpgid sigkill signal };
292 allow init keystore_data_file:dir { open create read getattr setattr search };
293 allow init keystore_data_file:file { getattr };
297 allow init vold_data_file:dir { open create read getattr setattr search };
298 allow init vold_data_file:file { getattr };
301 allow init shell_data_file:dir { open create read getattr setattr search };
302 allow init shell_data_file:file { getattr };
305 allow init self:capability { setuid setgid setpcap };
308 # we need to have following line to allow init to have access
310 r_dir_file(init, domain)
316 allow init self:process { setexec setfscreate setsockcreate };
319 allow init file_contexts_file:file r_file_perms;
322 allow init sepolicy_file:file r_file_perms;
325 selinux_check_access(init)
328 allow init kernel:security compute_create;
331 allow init domain:unix_stream_socket { create bind setopt };
332 allow init domain:unix_dgram_socket { create bind setopt };
335 allow init property_data_file:dir create_dir_perms;
336 allow init property_data_file:file create_file_perms;
339 allow init property_type:property_service set;
344 allow init self:netlink_audit_socket { create_socket_perms_no_ioctl nlmsg_relay };
345 allow init self:capability audit_write;
348 allow init self:udp_socket { create ioctl };
349 # in addition to unpriv ioctls granted to all domains, init also needs:
350 allowxperm init self:udp_socket ioctl SIOCSIFFLAGS;
351 allow init self:capability net_raw;
355 allow init kernel:process setsched;
359 allow init swap_block_device:blk_file rw_file_perms;
362 # system/core/init/init.c - mix_hwrng_into_linux_rng_action
363 allow init hw_random_device:chr_file r_file_perms;
368 # only ever accessed by init.
369 allow init device:file create_file_perms;
372 allow init self:capability sys_tty_config;
373 allow init keychord_device:chr_file rw_file_perms;
376 allow init dm_device:chr_file rw_file_perms;
377 allow init dm_device:blk_file rw_file_perms;
380 allow init metadata_block_device:blk_file rw_file_perms;
384 allow init pstorefs:dir search;
385 allow init pstorefs:file r_file_perms;
386 allow init kernel:system syslog_read;
389 allow init init:key { write search setattr };
391 # Allow init to create /data/unencrypted
392 allow init unencrypted_data_file:dir create_dir_perms;
394 # Allow init to write to /proc/sys/vm/overcommit_memory
395 allow init proc_overcommit_memory:file { write };
397 unix_socket_connect(init, vold, vold)
400 allow init misc_block_device:blk_file w_file_perms;
402 r_dir_file(init, system_file)
403 r_dir_file(init, vendor_file_type)
404 allow init proc_meminfo:file r_file_perms;
406 allow init system_data_file:file { getattr read };
407 allow init system_data_file:lnk_file r_file_perms;
409 # For init to be able to run shell scripts from vendor
410 allow init vendor_shell_exec:file execute;
416 # The init domain is only entered via an exec based transition from the
418 neverallow domain init:process dyntransition;
419 neverallow { domain -kernel } init:process transition;
420 neverallow init { file_type fs_type -init_exec }:file entrypoint;
423 neverallow init shell_data_file:lnk_file read;
424 neverallow init app_data_file:lnk_file read;
426 # init should never execute a program without changing to another domain.
427 neverallow init { file_type fs_type }:file execute_no_trans;
430 neverallow init service_manager_type:service_manager { add find };
431 neverallow init servicemanager:service_manager list;
434 neverallow init shell_data_file:dir { write add_name remove_name };