diff --git a/init.te b/init.te index 1d9dfec35289ccd6773087bd393c73a9da9926e6..03ae1c4965db14cd72a984c098b6bcfa6ed2ec44 100644 --- a/init.te +++ b/init.te @@ -329,6 +329,9 @@ allow init unencrypted_data_file:dir create_dir_perms; unix_socket_connect(init, vold, vold) +# Raw writes to misc block device +allow init misc_block_device:blk_file w_file_perms; + ### ### neverallow rules ### diff --git a/vold.te b/vold.te index 24a81861340062bfdeb47767a6283aa0b4cbfede..75b6f36660954f759629a1a5fcbd91c7872b1b15 100644 --- a/vold.te +++ b/vold.te @@ -188,6 +188,9 @@ allow vold toolbox_exec:file rx_file_perms; allow vold user_profile_data_file:dir create_dir_perms; allow vold user_profile_foreign_dex_data_file:dir { getattr setattr }; +# Raw writes to misc block device +allow vold misc_block_device:blk_file w_file_perms; + neverallow { domain -vold } vold_data_file:dir ~{ open create read getattr setattr search relabelto ioctl }; neverallow { domain -vold } vold_data_file:notdevfile_class_set ~{ relabelto getattr }; neverallow { domain -vold -init } vold_data_file:dir *;