Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 1 | # Filesystem types |
| 2 | type labeledfs, fs_type; |
| 3 | type pipefs, fs_type; |
| 4 | type sockfs, fs_type; |
| 5 | type rootfs, fs_type; |
| 6 | type proc, fs_type; |
Stephen Smalley | 7adb999 | 2013-12-06 09:31:40 -0500 | [diff] [blame] | 7 | # Security-sensitive proc nodes that should not be writable to most. |
| 8 | type proc_security, fs_type; |
| 9 | # proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers. |
| 10 | type usermodehelper, fs_type, sysfs_type; |
hqjiang | 4c06d27 | 2012-07-19 11:07:04 -0700 | [diff] [blame] | 11 | type qtaguid_proc, fs_type, mlstrustedobject; |
Robert Craig | 65d4f44 | 2013-03-27 06:30:25 -0400 | [diff] [blame] | 12 | type proc_bluetooth_writable, fs_type; |
Nick Kralevich | f2c0118 | 2014-09-26 10:51:12 -0700 | [diff] [blame] | 13 | type proc_cpuinfo, fs_type; |
Robert Craig | 529fcbe | 2014-01-07 13:46:56 -0500 | [diff] [blame] | 14 | type proc_net, fs_type; |
Stephen Smalley | 3dad7b6 | 2014-03-05 09:50:08 -0500 | [diff] [blame] | 15 | type proc_sysrq, fs_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 16 | type selinuxfs, fs_type; |
| 17 | type cgroup, fs_type, mlstrustedobject; |
Stephen Smalley | 9add1f0 | 2014-05-08 13:18:52 -0400 | [diff] [blame] | 18 | type sysfs, fs_type, sysfs_type, mlstrustedobject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 19 | type sysfs_writable, fs_type, sysfs_type, mlstrustedobject; |
Stephen Smalley | 61c80d5 | 2012-11-16 09:06:47 -0500 | [diff] [blame] | 20 | type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject; |
Stephen Smalley | f794823 | 2012-03-19 15:56:01 -0400 | [diff] [blame] | 21 | type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject; |
William Roberts | ec7d39b | 2013-09-28 18:46:21 -0400 | [diff] [blame] | 22 | type sysfs_wake_lock, fs_type, sysfs_type; |
Nick Kralevich | c4a3b51 | 2013-10-23 09:08:23 -0700 | [diff] [blame] | 23 | # /sys/devices/system/cpu |
| 24 | type sysfs_devices_system_cpu, fs_type, sysfs_type; |
Nick Kralevich | 5467fce | 2014-02-13 12:19:50 -0800 | [diff] [blame] | 25 | # /sys/module/lowmemorykiller |
| 26 | type sysfs_lowmemorykiller, fs_type, sysfs_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 27 | type inotify, fs_type, mlstrustedobject; |
Stephen Smalley | e884872 | 2012-11-13 13:00:05 -0500 | [diff] [blame] | 28 | type devpts, fs_type, mlstrustedobject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 29 | type tmpfs, fs_type; |
| 30 | type shm, fs_type; |
| 31 | type mqueue, fs_type; |
Ed Heyl | e9c90bd | 2014-07-14 23:29:21 -0700 | [diff] [blame] | 32 | type fuse, sdcard_type, fs_type, mlstrustedobject; |
| 33 | type vfat, sdcard_type, fs_type, mlstrustedobject; |
| 34 | typealias fuse alias sdcard_internal; |
| 35 | typealias vfat alias sdcard_external; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 36 | type debugfs, fs_type, mlstrustedobject; |
jaejyn.shin | 318e0c9 | 2014-04-10 13:32:54 +0900 | [diff] [blame] | 37 | type pstorefs, fs_type; |
Nick Kralevich | 77cc055 | 2014-04-15 14:53:05 -0700 | [diff] [blame] | 38 | type functionfs, fs_type; |
Stephen Smalley | d2503ba | 2014-05-30 08:49:51 -0400 | [diff] [blame] | 39 | type oemfs, fs_type, contextmount_type; |
Nick Kralevich | 5a5fb85 | 2014-06-07 07:31:31 -0700 | [diff] [blame] | 40 | type usbfs, fs_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 41 | |
| 42 | # File types |
| 43 | type unlabeled, file_type; |
| 44 | # Default type for anything under /system. |
| 45 | type system_file, file_type; |
Nick Kralevich | d7e004e | 2014-10-31 12:40:12 -0700 | [diff] [blame] | 46 | # /cores for coredumps on userdebug / eng builds |
| 47 | type coredump_file, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 48 | # Default type for anything under /data. |
| 49 | type system_data_file, file_type, data_file_type; |
Stephen Smalley | baf49bd | 2014-05-12 11:18:21 -0400 | [diff] [blame] | 50 | # /data/.layout_version or other installd-created files that |
| 51 | # are created in a system_data_file directory. |
| 52 | type install_data_file, file_type, data_file_type; |
Stephen Smalley | c83d008 | 2012-03-07 14:59:01 -0500 | [diff] [blame] | 53 | # /data/drm - DRM plugin data |
| 54 | type drm_data_file, file_type, data_file_type; |
Nick Kralevich | 7adc8cf | 2014-10-20 21:56:02 -0700 | [diff] [blame] | 55 | # /data/adb - adb debugging files |
| 56 | type adb_data_file, file_type, data_file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 57 | # /data/anr - ANR traces |
Stephen Smalley | a883c38 | 2012-04-04 16:00:11 -0400 | [diff] [blame] | 58 | type anr_data_file, file_type, data_file_type, mlstrustedobject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 59 | # /data/tombstones - core dumps |
| 60 | type tombstone_data_file, file_type, data_file_type; |
| 61 | # /data/app - user-installed apps |
Stephen Smalley | 59d2803 | 2012-03-19 10:24:52 -0400 | [diff] [blame] | 62 | type apk_data_file, file_type, data_file_type; |
| 63 | type apk_tmp_file, file_type, data_file_type, mlstrustedobject; |
Robert Craig | ffd8c44 | 2013-04-03 14:21:46 -0400 | [diff] [blame] | 64 | # /data/app-private - forward-locked apps |
| 65 | type apk_private_data_file, file_type, data_file_type; |
| 66 | type apk_private_tmp_file, file_type, data_file_type, mlstrustedobject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 67 | # /data/dalvik-cache |
| 68 | type dalvikcache_data_file, file_type, data_file_type; |
Stephen Smalley | 19c5090 | 2014-04-09 14:24:33 -0400 | [diff] [blame] | 69 | # /data/dalvik-cache/profiles |
| 70 | type dalvikcache_profiles_data_file, file_type, data_file_type; |
Nick Kralevich | fad4d5f | 2014-06-16 14:19:31 -0700 | [diff] [blame] | 71 | # /data/resource-cache |
| 72 | type resourcecache_data_file, file_type, data_file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 73 | # /data/local - writable by shell |
| 74 | type shell_data_file, file_type, data_file_type; |
| 75 | # /data/gps |
| 76 | type gps_data_file, file_type, data_file_type; |
Stephen Smalley | ad0d0fc | 2014-05-29 09:22:16 -0400 | [diff] [blame] | 77 | # /data/property |
| 78 | type property_data_file, file_type, data_file_type; |
Nick Kralevich | 6a32eec | 2013-12-12 15:23:10 -0800 | [diff] [blame] | 79 | |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 80 | # /data/misc subdirectories |
Nick Kralevich | 6a32eec | 2013-12-12 15:23:10 -0800 | [diff] [blame] | 81 | type adb_keys_file, file_type, data_file_type; |
Stephen Smalley | 8510d31 | 2013-11-07 13:42:46 -0500 | [diff] [blame] | 82 | type audio_data_file, file_type, data_file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 83 | type bluetooth_data_file, file_type, data_file_type; |
Stephen Smalley | 8510d31 | 2013-11-07 13:42:46 -0500 | [diff] [blame] | 84 | type camera_data_file, file_type, data_file_type; |
Robin Lee | 51bfecf | 2014-10-13 12:10:08 +0100 | [diff] [blame] | 85 | type keychain_data_file, file_type, data_file_type; |
Nick Kralevich | 6a32eec | 2013-12-12 15:23:10 -0800 | [diff] [blame] | 86 | type keystore_data_file, file_type, data_file_type; |
| 87 | type media_data_file, file_type, data_file_type; |
Stephen Smalley | e13fabd | 2013-12-17 14:39:35 -0500 | [diff] [blame] | 88 | type media_rw_data_file, file_type, data_file_type; |
Robin Lee | 51bfecf | 2014-10-13 12:10:08 +0100 | [diff] [blame] | 89 | type misc_user_data_file, file_type, data_file_type; |
Sreeram Ramachandran | 65edb75 | 2014-07-07 22:04:57 -0700 | [diff] [blame] | 90 | type net_data_file, file_type, data_file_type; |
Nick Kralevich | 6a32eec | 2013-12-12 15:23:10 -0800 | [diff] [blame] | 91 | type nfc_data_file, file_type, data_file_type; |
| 92 | type radio_data_file, file_type, data_file_type; |
Torne (Richard Coles) | 9786af2 | 2014-05-23 11:01:58 +0100 | [diff] [blame] | 93 | type shared_relro_file, file_type, data_file_type; |
Nick Kralevich | 6a32eec | 2013-12-12 15:23:10 -0800 | [diff] [blame] | 94 | type systemkeys_data_file, file_type, data_file_type; |
| 95 | type vpn_data_file, file_type, data_file_type; |
| 96 | type wifi_data_file, file_type, data_file_type; |
Nick Kralevich | 7466f9b | 2013-12-12 15:32:42 -0800 | [diff] [blame] | 97 | type zoneinfo_data_file, file_type, data_file_type; |
Nick Kralevich | 6a32eec | 2013-12-12 15:23:10 -0800 | [diff] [blame] | 98 | |
Stephen Smalley | 8510d31 | 2013-11-07 13:42:46 -0500 | [diff] [blame] | 99 | # Compatibility with type names used in vanilla Android 4.3 and 4.4. |
| 100 | typealias audio_data_file alias audio_firmware_file; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 101 | # /data/data subdirectories - app sandboxes |
| 102 | type app_data_file, file_type, data_file_type; |
Stephen Smalley | 91a4f8d | 2014-05-07 13:10:02 -0400 | [diff] [blame] | 103 | # /data/data subdirectory for system UID apps. |
| 104 | type system_app_data_file, file_type, data_file_type; |
Stephen Smalley | dc88dca | 2014-03-12 13:31:14 -0400 | [diff] [blame] | 105 | # Compatibility with type name used in Android 4.3 and 4.4. |
| 106 | typealias app_data_file alias platform_app_data_file; |
Stephen Smalley | f9c3257 | 2014-03-12 13:39:38 -0400 | [diff] [blame] | 107 | typealias app_data_file alias download_file; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 108 | # Default type for anything under /cache |
| 109 | type cache_file, file_type, mlstrustedobject; |
rpcraig | 1c8464e | 2012-12-04 08:13:58 -0500 | [diff] [blame] | 110 | # Type for /cache/.*\.{data|restore} and default |
| 111 | # type for anything under /cache/backup |
| 112 | type cache_backup_file, file_type, mlstrustedobject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 113 | # Default type for anything under /efs |
| 114 | type efs_file, file_type; |
Stephen Smalley | f6cbbe2 | 2012-03-19 10:29:36 -0400 | [diff] [blame] | 115 | # Type for wallpaper file. |
Stephen Smalley | 6c39ee0 | 2012-06-27 08:50:27 -0400 | [diff] [blame] | 116 | type wallpaper_file, file_type, mlstrustedobject; |
rpcraig | 7672eac | 2012-10-22 13:50:01 -0400 | [diff] [blame] | 117 | # /mnt/asec |
| 118 | type asec_apk_file, file_type, data_file_type; |
Robert Craig | 48b1883 | 2014-02-04 11:36:41 -0500 | [diff] [blame] | 119 | # Elements of asec files (/mnt/asec) that are world readable |
| 120 | type asec_public_file, file_type, data_file_type; |
rpcraig | 7672eac | 2012-10-22 13:50:01 -0400 | [diff] [blame] | 121 | # /data/app-asec |
| 122 | type asec_image_file, file_type, data_file_type; |
rpcraig | 1c8464e | 2012-12-04 08:13:58 -0500 | [diff] [blame] | 123 | # /data/backup and /data/secure/backup |
| 124 | type backup_data_file, file_type, data_file_type, mlstrustedobject; |
William Roberts | 9e70c8b | 2013-01-23 14:02:43 -0800 | [diff] [blame] | 125 | # For /data/security |
| 126 | type security_file, file_type; |
William Roberts | 7fa2f9e | 2012-05-31 09:40:12 -0400 | [diff] [blame] | 127 | # All devices have bluetooth efs files. But they |
| 128 | # vary per device, so this type is used in per |
William Roberts | c27d30a | 2012-09-06 18:50:35 -0700 | [diff] [blame] | 129 | # device policy |
William Roberts | 7fa2f9e | 2012-05-31 09:40:12 -0400 | [diff] [blame] | 130 | type bluetooth_efs_file, file_type; |
| 131 | |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 132 | # Socket types |
Stephen Smalley | 61c80d5 | 2012-11-16 09:06:47 -0500 | [diff] [blame] | 133 | type adbd_socket, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 134 | type bluetooth_socket, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 135 | type dnsproxyd_socket, file_type, mlstrustedobject; |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 136 | type dumpstate_socket, file_type; |
Sreeram Ramachandran | 56ecf4b | 2014-05-01 11:12:10 -0700 | [diff] [blame] | 137 | type fwmarkd_socket, file_type, mlstrustedobject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 138 | type gps_socket, file_type; |
| 139 | type installd_socket, file_type; |
Nick Kralevich | 2b392fc | 2013-12-05 16:55:34 -0800 | [diff] [blame] | 140 | type lmkd_socket, file_type; |
Mark Salyzyn | 8ed750e | 2013-11-12 15:34:52 -0800 | [diff] [blame] | 141 | type logd_debug, file_type; |
| 142 | type logd_socket, file_type; |
| 143 | type logdr_socket, file_type; |
| 144 | type logdw_socket, file_type; |
Stephen Smalley | 4caf8c9 | 2013-09-19 15:09:38 -0400 | [diff] [blame] | 145 | type mdns_socket, file_type; |
Stephen Smalley | 96ff4c0 | 2014-02-24 13:04:49 -0500 | [diff] [blame] | 146 | type mdnsd_socket, file_type; |
Stephen Smalley | 3dad7b6 | 2014-03-05 09:50:08 -0500 | [diff] [blame] | 147 | type mtpd_socket, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 148 | type netd_socket, file_type; |
| 149 | type property_socket, file_type; |
Robert Craig | 18b5f87 | 2013-01-07 09:21:18 -0500 | [diff] [blame] | 150 | type racoon_socket, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 151 | type rild_socket, file_type; |
| 152 | type rild_debug_socket, file_type; |
| 153 | type system_wpa_socket, file_type; |
Stephen Smalley | 45ba665 | 2013-09-27 10:24:49 -0400 | [diff] [blame] | 154 | type system_ndebug_socket, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 155 | type vold_socket, file_type; |
| 156 | type wpa_socket, file_type; |
| 157 | type zygote_socket, file_type; |
| 158 | |
hqjiang | 81039ab | 2012-07-10 14:36:22 -0700 | [diff] [blame] | 159 | # UART (for GPS) control proc file |
| 160 | type gps_control, file_type; |
| 161 | |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 162 | # Allow files to be created in their appropriate filesystems. |
| 163 | allow fs_type self:filesystem associate; |
| 164 | allow sysfs_type sysfs:filesystem associate; |
| 165 | allow file_type labeledfs:filesystem associate; |
| 166 | allow file_type tmpfs:filesystem associate; |
Stephen Smalley | 7aba0bc | 2013-05-10 11:29:35 -0400 | [diff] [blame] | 167 | allow file_type rootfs:filesystem associate; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 168 | allow dev_type tmpfs:filesystem associate; |
Nick Kralevich | 4821274 | 2014-06-15 08:41:55 -0700 | [diff] [blame] | 169 | |
| 170 | # It's a bug to assign the file_type attribute and fs_type attribute |
| 171 | # to any type. Do not allow it. |
| 172 | # |
| 173 | # For example, the following is a bug: |
| 174 | # type apk_data_file, file_type, data_file_type, fs_type; |
| 175 | # Should be: |
| 176 | # type apk_data_file, file_type, data_file_type; |
Stephen Smalley | d990a78 | 2014-07-29 14:50:30 -0400 | [diff] [blame] | 177 | neverallow fs_type file_type:filesystem associate; |