diff --git a/init.te b/init.te index c8b39eb379408e44282348d5b05463ce672a7c29..d8ed8b8f859dcab1dfe60d97ae163fcb3912f234 100644 --- a/init.te +++ b/init.te @@ -286,6 +286,9 @@ allow init unencrypted_data_file:dir create_dir_perms; unix_socket_connect(init, vold, vold) +# Raw writes to misc block device +allow init misc_block_device:blk_file w_file_perms; + ### ### neverallow rules ### diff --git a/vold.te b/vold.te index 56635622360e2ab905202d90c8754cdefa23e991..6d5d9942e044fa0d5aa98be4e0c25569ec7c8c54 100644 --- a/vold.te +++ b/vold.te @@ -189,6 +189,9 @@ allow vold toolbox_exec:file rx_file_perms; allow vold user_profile_data_file:dir create_dir_perms; allow vold user_profile_foreign_dex_data_file:dir { getattr setattr }; +# Raw writes to misc block device +allow vold misc_block_device:blk_file w_file_perms; + neverallow { domain -vold } vold_data_file:dir ~{ open create read getattr setattr search relabelto ioctl }; neverallow { domain -vold } vold_data_file:notdevfile_class_set ~{ relabelto getattr }; neverallow { domain -vold -init } vold_data_file:dir *;