kernel.te

# Life begins with the kernel.
type kernel, domain, domain_deprecated, mlstrustedsubject;

allow kernel self:capability sys_nice;

# Root fs.
allow kernel rootfs:dir r_dir_perms;
allow kernel rootfs:file r_file_perms;
allow kernel rootfs:lnk_file r_file_perms;

# Get SELinux enforcing status.
allow kernel selinuxfs:dir r_dir_perms;
allow kernel selinuxfs:file r_file_perms;

# Allow init relabel itself.
allow kernel rootfs:file relabelfrom;
allow kernel init_exec:file relabelto;
# TODO: investigate why we need this.
allow kernel init:process share;

# cgroup filesystem initialization prior to setting the cgroup root directory label.
allow kernel unlabeled:dir search;

# Mount usbfs.
allow kernel usbfs:filesystem mount;
allow kernel usbfs:dir search;

# Initial setenforce by init prior to switching to init domain.
# We use dontaudit instead of allow to prevent a kernel spawned userspace
# process from turning off SELinux once enabled.
dontaudit kernel self:security setenforce;

# Write to /proc/1/oom_adj prior to switching to init domain.
allow kernel self:capability sys_resource;

# Init reboot before switching selinux domains under certain error
# conditions. Allow it.
# As part of rebooting, init writes "u" to /proc/sysrq-trigger to
# remount filesystems read-only. /data is not mounted at this point,
# so we could ignore this. For now, we allow it.
allow kernel self:capability sys_boot;
allow kernel proc_sysrq:file w_file_perms;

# Allow writing to /dev/__kmsg__ which was created prior to
# loading policy
allow kernel tmpfs:chr_file write;

# Set checkreqprot by init.rc prior to switching to init domain.
allow kernel selinuxfs:file write;
allow kernel self:security setcheckreqprot;

# MTP sync (b/15835289)
# kernel thread "loop0", used by the loop block device, for ASECs (b/17158723)
allow kernel priv_app:fd use;
allow kernel sdcard_type:file { read write };

# Allow the kernel to read OBB files from app directories. (b/17428116)
# Kernel thread "loop0" reads a vold supplied file descriptor.
# Fixes CTS tests:
#  * android.os.storage.cts.StorageManagerTest#testMountAndUnmountObbNormal
#  * android.os.storage.cts.StorageManagerTest#testMountAndUnmountTwoObbs
allow kernel vold:fd use;
allow kernel app_data_file:file read;
allow kernel asec_image_file:file read;

# Allow reading loop device in update_engine_unittests. (b/28319454)
userdebug_or_eng(`
  allow kernel update_engine_data_file:file read;
  allow kernel nativetest_data_file:file read;
')