diff --git a/private/genfs_contexts b/private/genfs_contexts index 6386101120eb9dc5f95894975ef50e500e93a12f..efdfb422c007f2f34a83f2f2c7cd9f302a9d5b71 100644 --- a/private/genfs_contexts +++ b/private/genfs_contexts @@ -32,6 +32,7 @@ genfscon proc /timer_stats u:object_r:proc_timer:s0 genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0 genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0 genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0 +genfscon proc /uid_io/stats u:object_r:proc_uid_io_stats:s0 genfscon proc /uid_procstat/set u:object_r:proc_uid_procstat_set:s0 genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0 diff --git a/private/storaged.te b/private/storaged.te index 684f617bc25b0da4ec7834fd83b59e830f9bd222..6b7fa50ceea6cdf02f5233cec6ed3cb7d2a15abd 100644 --- a/private/storaged.te +++ b/private/storaged.te @@ -4,14 +4,14 @@ type storaged_exec, exec_type, file_type; init_daemon_domain(storaged) -# Write to /dev/kmsg (opened in init) -allow storaged kmsg_device:chr_file { write append }; - # Read access to pseudo filesystems r_dir_file(storaged, sysfs_type) r_dir_file(storaged, proc_net) r_dir_file(storaged, domain) +# Read /proc/uid_io/stats +allow storaged proc_uid_io_stats:file r_file_perms; + allow storaged self:capability { setgid setuid sys_nice sys_ptrace }; userdebug_or_eng(` @@ -22,6 +22,8 @@ userdebug_or_eng(` # Binder permissions allow storaged storaged_service:service_manager add; +allow storaged permission_service:service_manager find; + binder_use(storaged) binder_call(storaged, system_server) diff --git a/public/file.te b/public/file.te index 99c2a9e57ef1139b99bd4875192e4d6e72d04257..077b25a5f8c41f5a8aa657185f58f54d15da1d38 100644 --- a/public/file.te +++ b/public/file.te @@ -23,6 +23,7 @@ type proc_timer, fs_type; type proc_tty_drivers, fs_type; type proc_uid_cputime_showstat, fs_type; type proc_uid_cputime_removeuid, fs_type; +type proc_uid_io_stats, fs_type; type proc_uid_procstat_set, fs_type; type proc_zoneinfo, fs_type; type selinuxfs, fs_type, mlstrustedobject;