diff --git a/app.te b/app.te index d6a38041ea446b7df7b800e56831ec0543dcc8bb..105ae135f67e961071e31ebdaebf902db3af94b6 100644 --- a/app.te +++ b/app.te @@ -182,6 +182,8 @@ allow appdomain mnt_user_file:lnk_file r_file_perms; # Read/write visible storage allow appdomain fuse:dir create_dir_perms; allow appdomain fuse:file create_file_perms; +allow appdomain sdcardfs:dir create_dir_perms; +allow appdomain sdcardfs:file create_file_perms; # Access OBBs (vfat images) mounted by vold (b/17633509) # File write access allowed for FDs returned through Storage Access Framework diff --git a/file.te b/file.te index 56c5430011c0ea9d37877e90b8202e687d1980e8..c478880630db1a566831dc1d9cccbe7553e709ff 100644 --- a/file.te +++ b/file.te @@ -29,6 +29,7 @@ type sysfs_hwrandom, fs_type, sysfs_type; type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject; type sysfs_wake_lock, fs_type, sysfs_type; type sysfs_mac_address, fs_type, sysfs_type; +type configfs, fs_type; # /sys/devices/system/cpu type sysfs_devices_system_cpu, fs_type, sysfs_type; # /sys/module/lowmemorykiller @@ -41,6 +42,7 @@ type tmpfs, fs_type; type shm, fs_type; type mqueue, fs_type; type fuse, sdcard_type, fs_type, mlstrustedobject; +type sdcardfs, sdcard_type, fs_type, mlstrustedobject; type vfat, sdcard_type, fs_type, mlstrustedobject; type debugfs, fs_type; type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject; diff --git a/genfs_contexts b/genfs_contexts index 2700a945895ef4526fcc2a458732205e6ff66b41..d3d8bfb7ec3b8082754ee95731d27d5dfd134002 100644 --- a/genfs_contexts +++ b/genfs_contexts @@ -35,6 +35,8 @@ genfscon inotifyfs / u:object_r:inotify:s0 genfscon vfat / u:object_r:vfat:s0 genfscon debugfs / u:object_r:debugfs:s0 genfscon fuse / u:object_r:fuse:s0 +genfscon configfs / u:object_r:configfs:s0 +genfscon sdcardfs / u:object_r:sdcardfs:s0 genfscon pstore / u:object_r:pstorefs:s0 genfscon functionfs / u:object_r:functionfs:s0 genfscon usbfs / u:object_r:usbfs:s0 diff --git a/init.te b/init.te index 2d070dea231bcc47d98a338c7e9d5e64457e08be..29c324ab9d22f6d379adc8e3dc3cab08a9fbaf80 100644 --- a/init.te +++ b/init.te @@ -61,6 +61,10 @@ allow init tmpfs:dir mounton; allow init cgroup:dir create_dir_perms; allow init cpuctl_device:dir { create mounton }; +# /config +allow init configfs:dir mounton; +allow init configfs:dir create_dir_perms; + # Use tmpfs as /data, used for booting when /data is encrypted allow init tmpfs:dir relabelfrom; diff --git a/system_server.te b/system_server.te index 781c54936683305d26006fd3b832bbbd336700a5..7c61db22723f0af594ddc38f33747e9ed1c58d39 100644 --- a/system_server.te +++ b/system_server.te @@ -478,6 +478,10 @@ userdebug_or_eng(` allow system_server vold:fd use; allow system_server fuse_device:chr_file { read write ioctl getattr }; +# For configuring sdcardfs +allow system_server configfs:dir { create_dir_perms }; +allow system_server configfs:file { getattr open unlink write }; + # Connect to adbd and use a socket transferred from it. # Used for e.g. jdwp. allow system_server adbd:unix_stream_socket connectto; diff --git a/untrusted_app.te b/untrusted_app.te index 43c83a70b701f5550a94e36cf1d7eff3ce28e314..a2bd33aeb46e0adda8e5fb4b9c37764e67a516ac 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -168,6 +168,7 @@ neverallow untrusted_app property_type:property_service set; neverallow untrusted_app { fs_type -fuse # sdcard + -sdcardfs # sdcard file_type -app_data_file # The apps sandbox itself -media_rw_data_file # Internal storage. Known that apps can diff --git a/zygote.te b/zygote.te index aed950cc726710cbfcce0a9792e1da6ae1ef444a..9e155efb6ac6e16a7b076f1be28070e29589e0ce 100644 --- a/zygote.te +++ b/zygote.te @@ -52,6 +52,7 @@ allow zygote proc_cpuinfo:file mounton; allow zygote rootfs:dir mounton; allow zygote tmpfs:filesystem { mount unmount }; allow zygote fuse:filesystem { unmount }; +allow zygote sdcardfs:filesystem { unmount }; # Allowed to create user-specific storage source if started before vold allow zygote mnt_user_file:dir create_dir_perms;