Lines Matching refs:vold
2 type vold, domain;
6 allow vold cache_file:dir r_dir_perms;
7 allow vold cache_file:file { getattr read };
8 allow vold cache_file:lnk_file r_file_perms;
10 r_dir_file(vold, { sysfs_type -sysfs_batteryinfo })
12 allow vold {
22 r_dir_file(vold, rootfs)
23 r_dir_file(vold, metadata_file)
24 allow vold {
34 allow vold file_contexts_file:file r_file_perms;
37 allow vold self:process setexec;
40 allow vold e2fs_exec:file rx_file_perms;
44 allowxperm vold { fs_type file_type }:dir ioctl FITRIM;
47 allowxperm vold data_file_type:dir ioctl {
54 allowxperm vold vold_data_file:file ioctl {
58 typeattribute vold mlstrustedsubject;
59 allow vold self:process setfscreate;
60 allow vold system_file:file x_file_perms;
61 not_full_treble(`allow vold vendor_file:file x_file_perms;')
62 allow vold block_device:dir create_dir_perms;
63 allow vold device:dir write;
64 allow vold devpts:chr_file rw_file_perms;
65 allow vold rootfs:dir mounton;
66 allow vold sdcard_type:dir mounton; # TODO: deprecated in M
67 allow vold sdcard_type:filesystem { mount remount unmount }; # TODO: deprecated in M
68 allow vold sdcard_type:dir create_dir_perms; # TODO: deprecated in M
69 allow vold sdcard_type:file create_file_perms; # TODO: deprecated in M
72 allow vold { mnt_media_rw_file storage_file sdcard_type }:dir create_dir_perms;
73 allow vold { mnt_media_rw_file storage_file sdcard_type }:file create_file_perms;
76 allow vold media_rw_data_file:dir create_dir_perms;
77 allow vold media_rw_data_file:file create_file_perms;
80 allow vold { mnt_media_rw_stub_file storage_stub_file }:dir { mounton create rmdir getattr setattr …
83 allow vold mnt_user_file:dir { create_dir_perms mounton };
84 allow vold mnt_user_file:lnk_file create_file_perms;
85 allow vold mnt_user_file:file create_file_perms;
88 allow vold mnt_expand_file:dir { create_dir_perms mounton };
89 allow vold apk_data_file:dir { create getattr setattr };
90 allow vold shell_data_file:dir { create getattr setattr };
92 allow vold tmpfs:filesystem { mount unmount };
93 allow vold tmpfs:dir create_dir_perms;
94 allow vold tmpfs:dir mounton;
95 allow vold self:global_capability_class_set { net_admin dac_override dac_read_search mknod sys_admi…
96 allow vold self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
97 allow vold loop_control_device:chr_file rw_file_perms;
98 allow vold loop_device:blk_file { create setattr unlink rw_file_perms };
99 allowxperm vold loop_device:blk_file ioctl {
106 allow vold vold_device:blk_file { create setattr unlink rw_file_perms };
107 allowxperm vold vold_device:blk_file ioctl { BLKDISCARD BLKGETSIZE };
108 allow vold dm_device:chr_file rw_file_perms;
109 allow vold dm_device:blk_file rw_file_perms;
110 allowxperm vold dm_device:blk_file ioctl BLKSECDISCARD;
111 # For vold Process::killProcessesWithOpenFiles function.
112 allow vold domain:dir r_dir_perms;
113 allow vold domain:{ file lnk_file } r_file_perms;
114 allow vold domain:process { signal sigkill };
115 allow vold self:global_capability_class_set { sys_ptrace kill };
117 allow vold kmsg_device:chr_file rw_file_perms;
120 allow vold fsck_exec:file { r_file_perms execute };
123 allow vold fscklogs:dir rw_dir_perms;
124 allow vold fscklogs:file create_file_perms;
131 allow vold labeledfs:filesystem { mount unmount remount };
135 allow vold efs_file:file rw_file_perms;
138 allow vold system_data_file:dir { create rw_dir_perms mounton setattr rmdir };
139 allow vold system_data_file:lnk_file getattr;
142 allow vold vendor_data_file:dir create_dir_perms;
145 allow vold system_data_file:file read;
148 allow vold kernel:process setsched;
151 set_prop(vold, vold_prop)
152 set_prop(vold, exported_vold_prop)
153 set_prop(vold, exported2_vold_prop)
154 set_prop(vold, powerctl_prop)
155 set_prop(vold, ctl_fuse_prop)
156 set_prop(vold, restorecon_prop)
159 allow vold asec_image_file:file create_file_perms;
160 allow vold asec_image_file:dir rw_dir_perms;
161 allow vold asec_apk_file:dir { create_dir_perms mounton relabelfrom relabelto };
162 allow vold asec_public_file:dir { relabelto setattr };
163 allow vold asec_apk_file:file { r_file_perms setattr relabelfrom relabelto };
164 allow vold asec_public_file:file { relabelto setattr };
166 allow vold unlabeled:dir { r_dir_perms setattr relabelfrom };
167 allow vold unlabeled:file { r_file_perms setattr relabelfrom };
170 wakelock_use(vold)
172 # Allow vold to publish a binder service and make binder calls.
173 binder_use(vold)
174 add_service(vold, vold_service)
176 # Allow vold to call into the system server so it can check permissions.
177 binder_call(vold, system_server)
178 allow vold permission_service:service_manager find;
181 binder_call(vold, healthd)
184 hal_client_domain(vold, hal_keymaster)
187 hal_client_domain(vold, hal_health_storage)
190 full_treble_only(`hal_client_domain(vold, hal_bootctl)')
193 allow vold userdata_block_device:blk_file rw_file_perms;
194 allowxperm vold userdata_block_device:blk_file ioctl BLKSECDISCARD;
197 allow vold metadata_block_device:blk_file rw_file_perms;
199 # Allow vold to manipulate /data/unencrypted
200 allow vold unencrypted_data_file:{ file } create_file_perms;
201 allow vold unencrypted_data_file:dir create_dir_perms;
204 allow vold proc_drop_caches:file w_file_perms;
206 # Give vold a place where only vold can store files; everyone else is off limits
207 allow vold vold_data_file:dir create_dir_perms;
208 allow vold vold_data_file:file create_file_perms;
211 allow vold vold_metadata_file:dir create_dir_perms;
212 allow vold vold_metadata_file:file create_file_perms;
215 allow vold init:key { write search setattr };
216 allow vold vold:key { write search setattr };
218 # vold temporarily changes its priority when running benchmarks
219 allow vold self:global_capability_class_set sys_nice;
221 # vold needs to chroot into app namespaces to remount when runtime permissions change
222 allow vold self:global_capability_class_set sys_chroot;
223 allow vold storage_file:dir mounton;
226 allow vold fuse_device:chr_file rw_file_perms;
227 allow vold fuse:filesystem { relabelfrom };
228 allow vold app_fusefs:filesystem { relabelfrom relabelto };
229 allow vold app_fusefs:filesystem { mount unmount };
230 allow vold app_fuse_file:dir rw_dir_perms;
231 allow vold app_fuse_file:file { read write open getattr append };
234 allow vold toolbox_exec:file rx_file_perms;
237 allow vold user_profile_data_file:dir create_dir_perms;
240 allow vold misc_block_device:blk_file w_file_perms;
242 # vold might need to search or mount /mnt/vendor/*
243 allow vold mnt_vendor_file:dir search;
245 dontaudit vold self:global_capability_class_set sys_resource;
247 # vold needs to know whether we're running a GSI.
248 allow vold gsi_metadata_file:dir r_dir_perms;
249 allow vold gsi_metadata_file:file r_file_perms;
253 -vold
260 -vold
267 -vold
273 -vold
280 -vold
288 -vold
292 neverallow { domain -vold -init } restorecon_prop:property_service set;
298 -vold
303 neverallow vold {
318 neverallow vold fsck_exec:file execute_no_trans;
319 neverallow { domain -init } vold:process { transition dyntransition };
320 neverallow vold *:process ptrace;
321 neverallow vold *:rawip_socket *;