Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 1 | # Filesystem types |
| 2 | type labeledfs, fs_type; |
| 3 | type pipefs, fs_type; |
| 4 | type sockfs, fs_type; |
| 5 | type rootfs, fs_type; |
| 6 | type proc, fs_type; |
Stephen Smalley | 7adb999 | 2013-12-06 09:31:40 -0500 | [diff] [blame] | 7 | # Security-sensitive proc nodes that should not be writable to most. |
| 8 | type proc_security, fs_type; |
| 9 | # proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers. |
| 10 | type usermodehelper, fs_type, sysfs_type; |
hqjiang | 4c06d27 | 2012-07-19 11:07:04 -0700 | [diff] [blame] | 11 | type qtaguid_proc, fs_type, mlstrustedobject; |
Robert Craig | 65d4f44 | 2013-03-27 06:30:25 -0400 | [diff] [blame] | 12 | type proc_bluetooth_writable, fs_type; |
Robert Craig | 529fcbe | 2014-01-07 13:46:56 -0500 | [diff] [blame] | 13 | type proc_net, fs_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 14 | type selinuxfs, fs_type; |
| 15 | type cgroup, fs_type, mlstrustedobject; |
| 16 | type sysfs, fs_type, mlstrustedobject; |
| 17 | type sysfs_writable, fs_type, sysfs_type, mlstrustedobject; |
Stephen Smalley | 61c80d5 | 2012-11-16 09:06:47 -0500 | [diff] [blame] | 18 | type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject; |
Stephen Smalley | f794823 | 2012-03-19 15:56:01 -0400 | [diff] [blame] | 19 | type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject; |
William Roberts | ec7d39b | 2013-09-28 18:46:21 -0400 | [diff] [blame] | 20 | type sysfs_wake_lock, fs_type, sysfs_type; |
Nick Kralevich | c4a3b51 | 2013-10-23 09:08:23 -0700 | [diff] [blame] | 21 | # /sys/devices/system/cpu |
| 22 | type sysfs_devices_system_cpu, fs_type, sysfs_type; |
Nick Kralevich | 5467fce | 2014-02-13 12:19:50 -0800 | [diff] [blame] | 23 | # /sys/module/lowmemorykiller |
| 24 | type sysfs_lowmemorykiller, fs_type, sysfs_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 25 | type inotify, fs_type, mlstrustedobject; |
Stephen Smalley | e884872 | 2012-11-13 13:00:05 -0500 | [diff] [blame] | 26 | type devpts, fs_type, mlstrustedobject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 27 | type tmpfs, fs_type; |
| 28 | type shm, fs_type; |
| 29 | type mqueue, fs_type; |
William Roberts | c195ec3 | 2013-03-06 16:26:36 -0800 | [diff] [blame] | 30 | type sdcard_internal, sdcard_type, fs_type, mlstrustedobject; |
| 31 | type sdcard_external, sdcard_type, fs_type, mlstrustedobject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 32 | type debugfs, fs_type, mlstrustedobject; |
| 33 | |
| 34 | # File types |
| 35 | type unlabeled, file_type; |
| 36 | # Default type for anything under /system. |
| 37 | type system_file, file_type; |
| 38 | # Default type for anything under /data. |
| 39 | type system_data_file, file_type, data_file_type; |
Stephen Smalley | c83d008 | 2012-03-07 14:59:01 -0500 | [diff] [blame] | 40 | # /data/drm - DRM plugin data |
| 41 | type drm_data_file, file_type, data_file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 42 | # /data/anr - ANR traces |
Stephen Smalley | a883c38 | 2012-04-04 16:00:11 -0400 | [diff] [blame] | 43 | type anr_data_file, file_type, data_file_type, mlstrustedobject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 44 | # /data/tombstones - core dumps |
| 45 | type tombstone_data_file, file_type, data_file_type; |
| 46 | # /data/app - user-installed apps |
Stephen Smalley | 59d2803 | 2012-03-19 10:24:52 -0400 | [diff] [blame] | 47 | type apk_data_file, file_type, data_file_type; |
| 48 | type apk_tmp_file, file_type, data_file_type, mlstrustedobject; |
Robert Craig | ffd8c44 | 2013-04-03 14:21:46 -0400 | [diff] [blame] | 49 | # /data/app-private - forward-locked apps |
| 50 | type apk_private_data_file, file_type, data_file_type; |
| 51 | type apk_private_tmp_file, file_type, data_file_type, mlstrustedobject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 52 | # /data/dalvik-cache |
| 53 | type dalvikcache_data_file, file_type, data_file_type; |
| 54 | # /data/local - writable by shell |
| 55 | type shell_data_file, file_type, data_file_type; |
| 56 | # /data/gps |
| 57 | type gps_data_file, file_type, data_file_type; |
Nick Kralevich | 6a32eec | 2013-12-12 15:23:10 -0800 | [diff] [blame] | 58 | |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 59 | # /data/misc subdirectories |
Nick Kralevich | 6a32eec | 2013-12-12 15:23:10 -0800 | [diff] [blame] | 60 | type adb_keys_file, file_type, data_file_type; |
Stephen Smalley | 8510d31 | 2013-11-07 13:42:46 -0500 | [diff] [blame] | 61 | type audio_data_file, file_type, data_file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 62 | type bluetooth_data_file, file_type, data_file_type; |
Stephen Smalley | 8510d31 | 2013-11-07 13:42:46 -0500 | [diff] [blame] | 63 | type camera_data_file, file_type, data_file_type; |
Nick Kralevich | 6a32eec | 2013-12-12 15:23:10 -0800 | [diff] [blame] | 64 | type keystore_data_file, file_type, data_file_type; |
| 65 | type media_data_file, file_type, data_file_type; |
Stephen Smalley | e13fabd | 2013-12-17 14:39:35 -0500 | [diff] [blame] | 66 | type media_rw_data_file, file_type, data_file_type; |
Nick Kralevich | 6a32eec | 2013-12-12 15:23:10 -0800 | [diff] [blame] | 67 | type nfc_data_file, file_type, data_file_type; |
| 68 | type radio_data_file, file_type, data_file_type; |
| 69 | type systemkeys_data_file, file_type, data_file_type; |
| 70 | type vpn_data_file, file_type, data_file_type; |
| 71 | type wifi_data_file, file_type, data_file_type; |
Nick Kralevich | 7466f9b | 2013-12-12 15:32:42 -0800 | [diff] [blame] | 72 | type zoneinfo_data_file, file_type, data_file_type; |
Nick Kralevich | 6a32eec | 2013-12-12 15:23:10 -0800 | [diff] [blame] | 73 | |
Stephen Smalley | 8510d31 | 2013-11-07 13:42:46 -0500 | [diff] [blame] | 74 | # Compatibility with type names used in vanilla Android 4.3 and 4.4. |
| 75 | typealias audio_data_file alias audio_firmware_file; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 76 | # /data/data subdirectories - app sandboxes |
| 77 | type app_data_file, file_type, data_file_type; |
Stephen Smalley | b9760aa | 2012-07-27 11:07:09 -0400 | [diff] [blame] | 78 | type platform_app_data_file, file_type, data_file_type, mlstrustedobject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 79 | # Default type for anything under /cache |
| 80 | type cache_file, file_type, mlstrustedobject; |
rpcraig | 1c8464e | 2012-12-04 08:13:58 -0500 | [diff] [blame] | 81 | # Type for /cache/.*\.{data|restore} and default |
| 82 | # type for anything under /cache/backup |
| 83 | type cache_backup_file, file_type, mlstrustedobject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 84 | # Default type for anything under /efs |
| 85 | type efs_file, file_type; |
Stephen Smalley | f6cbbe2 | 2012-03-19 10:29:36 -0400 | [diff] [blame] | 86 | # Type for wallpaper file. |
Stephen Smalley | 6c39ee0 | 2012-06-27 08:50:27 -0400 | [diff] [blame] | 87 | type wallpaper_file, file_type, mlstrustedobject; |
rpcraig | 7672eac | 2012-10-22 13:50:01 -0400 | [diff] [blame] | 88 | # /mnt/asec |
| 89 | type asec_apk_file, file_type, data_file_type; |
Robert Craig | 48b1883 | 2014-02-04 11:36:41 -0500 | [diff] [blame] | 90 | # Elements of asec files (/mnt/asec) that are world readable |
| 91 | type asec_public_file, file_type, data_file_type; |
rpcraig | 7672eac | 2012-10-22 13:50:01 -0400 | [diff] [blame] | 92 | # /data/app-asec |
| 93 | type asec_image_file, file_type, data_file_type; |
rpcraig | 1c8464e | 2012-12-04 08:13:58 -0500 | [diff] [blame] | 94 | # /data/backup and /data/secure/backup |
| 95 | type backup_data_file, file_type, data_file_type, mlstrustedobject; |
William Roberts | 9e70c8b | 2013-01-23 14:02:43 -0800 | [diff] [blame] | 96 | # For /data/security |
| 97 | type security_file, file_type; |
William Roberts | 7fa2f9e | 2012-05-31 09:40:12 -0400 | [diff] [blame] | 98 | # All devices have bluetooth efs files. But they |
| 99 | # vary per device, so this type is used in per |
William Roberts | c27d30a | 2012-09-06 18:50:35 -0700 | [diff] [blame] | 100 | # device policy |
William Roberts | 7fa2f9e | 2012-05-31 09:40:12 -0400 | [diff] [blame] | 101 | type bluetooth_efs_file, file_type; |
Geremy Condra | bfb26e7 | 2013-04-03 17:41:22 -0700 | [diff] [blame] | 102 | # Downloaded files |
| 103 | type download_file, file_type; |
William Roberts | 7fa2f9e | 2012-05-31 09:40:12 -0400 | [diff] [blame] | 104 | |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 105 | # Socket types |
Stephen Smalley | 61c80d5 | 2012-11-16 09:06:47 -0500 | [diff] [blame] | 106 | type adbd_socket, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 107 | type bluetooth_socket, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 108 | type dnsproxyd_socket, file_type, mlstrustedobject; |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 109 | type dumpstate_socket, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 110 | type gps_socket, file_type; |
| 111 | type installd_socket, file_type; |
| 112 | type keystore_socket, file_type; |
Nick Kralevich | 2b392fc | 2013-12-05 16:55:34 -0800 | [diff] [blame] | 113 | type lmkd_socket, file_type; |
Mark Salyzyn | 8ed750e | 2013-11-12 15:34:52 -0800 | [diff] [blame] | 114 | type logd_debug, file_type; |
| 115 | type logd_socket, file_type; |
| 116 | type logdr_socket, file_type; |
| 117 | type logdw_socket, file_type; |
Stephen Smalley | 4caf8c9 | 2013-09-19 15:09:38 -0400 | [diff] [blame] | 118 | type mdns_socket, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 119 | type netd_socket, file_type; |
| 120 | type property_socket, file_type; |
| 121 | type qemud_socket, file_type; |
Robert Craig | 18b5f87 | 2013-01-07 09:21:18 -0500 | [diff] [blame] | 122 | type racoon_socket, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 123 | type rild_socket, file_type; |
| 124 | type rild_debug_socket, file_type; |
| 125 | type system_wpa_socket, file_type; |
Stephen Smalley | 45ba665 | 2013-09-27 10:24:49 -0400 | [diff] [blame] | 126 | type system_ndebug_socket, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 127 | type vold_socket, file_type; |
| 128 | type wpa_socket, file_type; |
| 129 | type zygote_socket, file_type; |
| 130 | |
hqjiang | 81039ab | 2012-07-10 14:36:22 -0700 | [diff] [blame] | 131 | # UART (for GPS) control proc file |
| 132 | type gps_control, file_type; |
| 133 | |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 134 | # Allow files to be created in their appropriate filesystems. |
| 135 | allow fs_type self:filesystem associate; |
| 136 | allow sysfs_type sysfs:filesystem associate; |
| 137 | allow file_type labeledfs:filesystem associate; |
| 138 | allow file_type tmpfs:filesystem associate; |
Stephen Smalley | 7aba0bc | 2013-05-10 11:29:35 -0400 | [diff] [blame] | 139 | allow file_type rootfs:filesystem associate; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 140 | allow dev_type tmpfs:filesystem associate; |