Something went wrong on our end
-
Nick Kralevich authoredIf the sdcard daemon is restarted (crash or otherwise), one of the first things it attempts to do is umount the previously mounted /mnt/shell/emulated fuse filesystem, which is denied by SELinux with the following denial: sdcard : type=1400 audit(0.0:6997): avc: denied { unmount } for scontext=u:r:sdcardd:s0 tcontext=u:object_r:fuse:s0 tclass=filesystem permissive=0 Allow the operation. Steps to reproduce: 1) adb shell into the device and su to root 2) run "kill -9 [PID OF SDCARD] Expected: sdcard daemon successfully restarts without error message. Actual: SELinux denial above, plus attempts to mount a new filesystem on top of the existing filesystem. (cherrypicked from commit abfd427a) Bug: 17383009 Change-Id: I386bfc98e2b5b32b1d11408f7cfbd6e3c1af68f4Nick Kralevich authoredIf the sdcard daemon is restarted (crash or otherwise), one of the first things it attempts to do is umount the previously mounted /mnt/shell/emulated fuse filesystem, which is denied by SELinux with the following denial: sdcard : type=1400 audit(0.0:6997): avc: denied { unmount } for scontext=u:r:sdcardd:s0 tcontext=u:object_r:fuse:s0 tclass=filesystem permissive=0 Allow the operation. Steps to reproduce: 1) adb shell into the device and su to root 2) run "kill -9 [PID OF SDCARD] Expected: sdcard daemon successfully restarts without error message. Actual: SELinux denial above, plus attempts to mount a new filesystem on top of the existing filesystem. (cherrypicked from commit abfd427a) Bug: 17383009 Change-Id: I386bfc98e2b5b32b1d11408f7cfbd6e3c1af68f4
sdcardd.te 814 B
type sdcardd, domain;
type sdcardd_exec, exec_type, file_type;
init_daemon_domain(sdcardd)
allow sdcardd cgroup:dir create_dir_perms;
allow sdcardd fuse_device:chr_file rw_file_perms;
allow sdcardd rootfs:dir mounton;
allow sdcardd sdcard_type:filesystem { mount unmount };
allow sdcardd self:capability { setuid setgid dac_override sys_admin sys_resource };
allow sdcardd sdcard_type:dir create_dir_perms;
allow sdcardd sdcard_type:file create_file_perms;
type_transition sdcardd system_data_file:{ dir file } media_rw_data_file;
allow sdcardd media_rw_data_file:dir create_dir_perms;
allow sdcardd media_rw_data_file:file create_file_perms;
# Read /data/system/packages.list.
allow sdcardd system_data_file:file r_file_perms;
# Read /data/.layout_version
allow sdcardd install_data_file:file r_file_perms;