path: root/common/sepolicy/vold.te (plain)
blob: 941869800af976cb163ca0e68631edb524a9f796

1	# NTFS
2	userdebug_or_eng(`
3	allow vold self:capability { sys_rawio };
4	')
5	allow vold self:capability { setgid setuid };
6
7	allow vold cpuctl_device:dir search;
8
9	allow vold device:dir { open read };
10	allow vold usb_device:dir { open read search };
11	allow vold system_data_file:fifo_file { open read write };
12	allow vold kernel:system { module_request };
13
14	domain_auto_trans(vold, vold_ext_exec, vold_ext)
15	allow vold vold_ext_exec:file { execute read open execute_no_trans };
16	allow vold kernel:system module_request;
17	allow vold mnt_media_rw_stub_file:dir { r_dir_perms mounton };
18	allow vold sda_block_device:blk_file rw_file_perms;
19
20	#for dig
21	allow vold cache_file:file create_file_perms;
22	allow vold cache_file:dir { create_file_perms add_name remove_name };
23
24	allow vold vold_block_device:blk_file { create getattr read open unlink ioctl lock write };
25	allow vold param_tv_file:dir { read open };
26
27	allow vold storage_stub_file:dir { getattr read open search write add_name };
28
29	# for make ext4fs
30	domain_auto_trans(vold, make_ext4fs_exec, make_ext4fs);
31
32	allow vold tee_data_file:dir { open read };
33
34	allow vold vold_block_device:blk_file { create read open ioctl unlink };
35
36	allow vold apk_data_file:dir { getattr open read };
37
38	#for hw keymaster
39	allow vold drm_device:chr_file {open read write ioctl};
40