diff options
author | Jeff Sharkey | 2018-03-30 13:22:54 -0500 |
---|---|---|
committer | Jeff Sharkey | 2018-04-13 15:08:10 -0500 |
commit | 000cafc70120e26a1c0918d5cedff1a646521c11 (patch) | |
tree | fc04629382cb5f866c1d88fdd9f2d1af46cd2406 /private | |
parent | db465285cfe5724d83021888c42ba93f0e8ee415 (diff) | |
download | system-sepolicy-000cafc70120e26a1c0918d5cedff1a646521c11.tar.gz system-sepolicy-000cafc70120e26a1c0918d5cedff1a646521c11.tar.xz system-sepolicy-000cafc70120e26a1c0918d5cedff1a646521c11.zip |
Add exFAT support; unify behind "sdcard_type".
We're adding support for OEMs to ship exFAT, which behaves identical
to vfat. Some rules have been manually enumerating labels related
to these "public" volumes, so unify them all behind "sdcard_type".
Test: atest
Bug: 67822822
Change-Id: I09157fd1fc666ec5d98082c6e2cefce7c8d3ae56
Diffstat (limited to 'private')
-rw-r--r-- | private/app_neverallows.te | 4 | ||||
-rw-r--r-- | private/compat/26.0/26.0.ignore.cil | 1 | ||||
-rw-r--r-- | private/compat/27.0/27.0.ignore.cil | 1 | ||||
-rw-r--r-- | private/genfs_contexts | 1 | ||||
-rw-r--r-- | private/platform_app.te | 4 |
5 files changed, 6 insertions, 5 deletions
diff --git a/private/app_neverallows.te b/private/app_neverallows.te index 4b79060e..3bdbfb18 100644 --- a/private/app_neverallows.te +++ b/private/app_neverallows.te | |||
@@ -93,9 +93,7 @@ neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_fil | |||
93 | # application un-installation. | 93 | # application un-installation. |
94 | neverallow { all_untrusted_apps -mediaprovider } { | 94 | neverallow { all_untrusted_apps -mediaprovider } { |
95 | fs_type | 95 | fs_type |
96 | -fuse # sdcard | 96 | -sdcard_type |
97 | -sdcardfs # sdcard | ||
98 | -vfat | ||
99 | file_type | 97 | file_type |
100 | -app_data_file # The apps sandbox itself | 98 | -app_data_file # The apps sandbox itself |
101 | -media_rw_data_file # Internal storage. Known that apps can | 99 | -media_rw_data_file # Internal storage. Known that apps can |
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil index ab58ddaa..68d6b409 100644 --- a/private/compat/26.0/26.0.ignore.cil +++ b/private/compat/26.0/26.0.ignore.cil | |||
@@ -19,6 +19,7 @@ | |||
19 | crossprofileapps_service | 19 | crossprofileapps_service |
20 | e2fs | 20 | e2fs |
21 | e2fs_exec | 21 | e2fs_exec |
22 | exfat | ||
22 | exported_bluetooth_prop | 23 | exported_bluetooth_prop |
23 | exported_config_prop | 24 | exported_config_prop |
24 | exported_dalvik_prop | 25 | exported_dalvik_prop |
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil index 493ac312..1eaf22a7 100644 --- a/private/compat/27.0/27.0.ignore.cil +++ b/private/compat/27.0/27.0.ignore.cil | |||
@@ -15,6 +15,7 @@ | |||
15 | bpfloader_exec | 15 | bpfloader_exec |
16 | cgroup_bpf | 16 | cgroup_bpf |
17 | crossprofileapps_service | 17 | crossprofileapps_service |
18 | exfat | ||
18 | exported2_config_prop | 19 | exported2_config_prop |
19 | exported2_default_prop | 20 | exported2_default_prop |
20 | exported2_radio_prop | 21 | exported2_radio_prop |
diff --git a/private/genfs_contexts b/private/genfs_contexts index f2b96990..1d321d81 100644 --- a/private/genfs_contexts +++ b/private/genfs_contexts | |||
@@ -238,6 +238,7 @@ genfscon debugfs /tracing/events/lowmemorykiller/ | |||
238 | 238 | ||
239 | genfscon inotifyfs / u:object_r:inotify:s0 | 239 | genfscon inotifyfs / u:object_r:inotify:s0 |
240 | genfscon vfat / u:object_r:vfat:s0 | 240 | genfscon vfat / u:object_r:vfat:s0 |
241 | genfscon exfat / u:object_r:exfat:s0 | ||
241 | genfscon debugfs / u:object_r:debugfs:s0 | 242 | genfscon debugfs / u:object_r:debugfs:s0 |
242 | genfscon fuse / u:object_r:fuse:s0 | 243 | genfscon fuse / u:object_r:fuse:s0 |
243 | genfscon configfs / u:object_r:configfs:s0 | 244 | genfscon configfs / u:object_r:configfs:s0 |
diff --git a/private/platform_app.te b/private/platform_app.te index 80b20e14..f60597a7 100644 --- a/private/platform_app.te +++ b/private/platform_app.te | |||
@@ -34,8 +34,8 @@ allow platform_app cache_file:file create_file_perms; | |||
34 | # Direct access to vold-mounted storage under /mnt/media_rw | 34 | # Direct access to vold-mounted storage under /mnt/media_rw |
35 | # This is a performance optimization that allows platform apps to bypass the FUSE layer | 35 | # This is a performance optimization that allows platform apps to bypass the FUSE layer |
36 | allow platform_app mnt_media_rw_file:dir r_dir_perms; | 36 | allow platform_app mnt_media_rw_file:dir r_dir_perms; |
37 | allow platform_app vfat:dir create_dir_perms; | 37 | allow platform_app sdcard_type:dir create_dir_perms; |
38 | allow platform_app vfat:file create_file_perms; | 38 | allow platform_app sdcard_type:file create_file_perms; |
39 | 39 | ||
40 | # com.android.systemui | 40 | # com.android.systemui |
41 | allow platform_app rootfs:dir getattr; | 41 | allow platform_app rootfs:dir getattr; |