Skip to content
Snippets Groups Projects
Select Git revision
  • a60342b7a4210e70782384b2d0b51bbe2afb3a63
  • master default protected
  • android-7.1.2_r28_klist
  • pie-cts-release
  • pie-vts-release
  • pie-cts-dev
  • oreo-mr1-iot-release
  • sdk-release
  • oreo-m6-s4-release
  • oreo-m4-s12-release
  • pie-release
  • pie-r2-release
  • pie-r2-s1-release
  • oreo-vts-release
  • oreo-cts-release
  • oreo-dev
  • oreo-mr1-dev
  • pie-gsi
  • pie-platform-release
  • pie-dev
  • oreo-cts-dev
  • android-o-mr1-iot-release-1.0.4
  • android-9.0.0_r8
  • android-9.0.0_r7
  • android-9.0.0_r6
  • android-9.0.0_r5
  • android-8.1.0_r46
  • android-8.1.0_r45
  • android-n-iot-release-smart-display-r2
  • android-vts-8.1_r5
  • android-cts-8.1_r8
  • android-cts-8.0_r12
  • android-cts-7.1_r20
  • android-cts-7.0_r24
  • android-o-mr1-iot-release-1.0.3
  • android-cts-9.0_r1
  • android-8.1.0_r43
  • android-8.1.0_r42
  • android-n-iot-release-smart-display
  • android-p-preview-5
  • android-9.0.0_r3
41 results

domain_deprecated.te

Blame
  • domain_deprecated.te 2.79 KiB
    # rules removed from the domain attribute
    
    # Read access to properties mapping.
    allow domain_deprecated kernel:fd use;
    allow domain_deprecated tmpfs:file { read getattr };
    allow domain_deprecated tmpfs:lnk_file { read getattr };
    
    # Search /storage/emulated tmpfs mount.
    allow domain_deprecated tmpfs:dir r_dir_perms;
    
    # Inherit or receive open files from others.
    allow domain_deprecated system_server:fd use;
    
    # Connect to adbd and use a socket transferred from it.
    # This is used for e.g. adb backup/restore.
    allow domain_deprecated adbd:unix_stream_socket connectto;
    allow domain_deprecated adbd:fd use;
    allow domain_deprecated adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
    
    # Root fs.
    allow domain_deprecated rootfs:dir r_dir_perms;
    allow domain_deprecated rootfs:file r_file_perms;
    allow domain_deprecated rootfs:lnk_file r_file_perms;
    
    # Device accesses.
    allow domain_deprecated device:file read;
    
    # System file accesses.
    allow domain_deprecated system_file:dir r_dir_perms;
    allow domain_deprecated system_file:file r_file_perms;
    allow domain_deprecated system_file:lnk_file r_file_perms;
    
    # Read files already opened under /data.
    allow domain_deprecated system_data_file:dir { search getattr };
    allow domain_deprecated system_data_file:file { getattr read };
    allow domain_deprecated system_data_file:lnk_file r_file_perms;
    
    # Read apk files under /data/app.
    allow domain_deprecated apk_data_file:dir { getattr search };
    allow domain_deprecated apk_data_file:file r_file_perms;
    allow domain_deprecated apk_data_file:lnk_file r_file_perms;
    
    # Read /data/dalvik-cache.
    allow domain_deprecated dalvikcache_data_file:dir { search getattr };
    allow domain_deprecated dalvikcache_data_file:file r_file_perms;
    
    # Read already opened /cache files.
    allow domain_deprecated cache_file:dir r_dir_perms;
    allow domain_deprecated cache_file:file { getattr read };
    allow domain_deprecated cache_file:lnk_file r_file_perms;
    
    #Allow access to ion memory allocation device
    allow domain_deprecated ion_device:chr_file rw_file_perms;
    
    # Read access to pseudo filesystems.
    r_dir_file(domain_deprecated, proc)
    r_dir_file({ domain_deprecated -isolated_app }, sysfs)
    r_dir_file(domain_deprecated, inotify)
    r_dir_file(domain_deprecated, cgroup)
    allow domain_deprecated proc_meminfo:file r_file_perms;
    r_dir_file(domain_deprecated, proc_net)
    
    # Get SELinux enforcing status.
    allow domain_deprecated selinuxfs:dir r_dir_perms;
    allow domain_deprecated selinuxfs:file r_file_perms;
    
    # /data/security files
    allow domain_deprecated security_file:dir { search getattr };
    allow domain_deprecated security_file:file getattr;
    allow domain_deprecated security_file:lnk_file r_file_perms;
    
    # World readable asec image contents
    allow domain_deprecated asec_public_file:file r_file_perms;
    allow domain_deprecated { asec_public_file asec_apk_file }:dir r_dir_perms;