sepolicy/init.te


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

#For holding a wake_lock in init.rc
wakelock_use(init)

#For loading modules via init.rc
allow init self:capability sys_module;

#Create symlinks for storage
allow init tmpfs:lnk_file create_file_perms;

# Allow module insertion
allow init vendor_file:system module_load;

# Configfs
allow init configfs:file write;
allow init configfs:lnk_file { create unlink } ;

# For cgroups creating
allow init cgroup:file create;

# Access to /proc
allow init proc:dir { add_name write };
allow init proc:file create;

# Access to /sys
allow init sysfs:file create;
allow init sysfs:dir add_name;

dontaudit init self:capability dac_read_search;