5c601a9ada
/dev/ut_keymaster is used by keymaster. Label it and allow relevant permissions
which domains using it (vold, tee and keymaster) requires.
Denial observed without this change:
[ 46.666247] .(2)[399:logd.auditd]type=1400 audit(1609128921.744:392): avc: denied { ioctl } for comm="keymaster@3.0-s" path="/dev/ut_keymaster" dev="tmpfs" ino=17464 ioctlcmd=0x5402 scontext=u:r:hal_keymaster_default:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=1
Test: Boot and notice that denial no longer appears
Signed-off-by: Aayush Gupta <aayushgupta219@gmail.com>
Change-Id: Iee0126d637a139397db8857d8a780277c3ea4576
51 lines
1.8 KiB
Plaintext
51 lines
1.8 KiB
Plaintext
# ==============================================
|
|
# MTK Policy Rule
|
|
# ==============================================
|
|
|
|
# volume manager
|
|
|
|
# Date : WK16.19
|
|
# Operation : Migration
|
|
# Purpose : unmount /mnt/cd-rom. It causes by unmountAll() when VolumeManager starts
|
|
allow vold iso9660:filesystem unmount;
|
|
|
|
# Date : WK16.19
|
|
# Operation : Migration
|
|
# Purpose : vold will traverse /proc when remountUid().
|
|
# It will trigger violation if mtk customize some label in /proc.
|
|
# However, we should ignore the violation if the processes never access the storage.
|
|
dontaudit vold proc_battery_cmd:dir { read open };
|
|
dontaudit vold proc_mtkcooler:dir { read open };
|
|
dontaudit vold proc_mtktz:dir { read open };
|
|
dontaudit vold proc_thermal:dir { read open };
|
|
|
|
# Date : WK18.30
|
|
# Operation : Migration
|
|
# Purpose : vold create mdlog folder in data for meta mode.
|
|
allow vold mdlog_data_file:dir { create_dir_perms };
|
|
|
|
allow vold mtd_device:blk_file rw_file_perms;
|
|
|
|
# dontaudit for fstrim on 'vendor' folder
|
|
dontaudit vold nvdata_file:dir r_dir_perms;
|
|
dontaudit vold nvcfg_file:dir r_dir_perms;
|
|
dontaudit vold protect_f_data_file:dir r_dir_perms;
|
|
dontaudit vold protect_s_data_file:dir r_dir_perms;
|
|
|
|
# execute mke2fs when format as internal
|
|
allow vold cache_block_device:blk_file getattr;
|
|
allowxperm vold dm_device:blk_file ioctl {
|
|
BLKSECDISCARD BLKDISCARD BLKPBSZGET BLKDISCARDZEROES BLKROGET
|
|
};
|
|
allow vold nvcfg_block_device:blk_file getattr;
|
|
allow vold nvdata_device:blk_file getattr;
|
|
allow vold proc_swaps:file r_file_perms;
|
|
allow vold protect1_block_device:blk_file getattr;
|
|
allow vold protect2_block_device:blk_file getattr;
|
|
allow vold proc_swaps:file getattr;
|
|
allow vold swap_block_device:blk_file getattr;
|
|
|
|
allow vold sysfs_mmcblk:file rw_file_perms;
|
|
|
|
allow vold ut_keymaster_device:chr_file { read write open ioctl};
|