| # storaged daemon |
| type storaged, domain, coredomain, mlstrustedsubject; |
| type storaged_exec, exec_type, file_type; |
| |
| init_daemon_domain(storaged) |
| |
| # Read access to pseudo filesystems |
| r_dir_file(storaged, sysfs_type) |
| r_dir_file(storaged, proc_net) |
| r_dir_file(storaged, domain) |
| |
| # Read /proc/uid_io/stats |
| allow storaged proc_uid_io_stats:file r_file_perms; |
| |
| # Read /data/system/packages.list |
| allow storaged system_data_file:file r_file_perms; |
| |
| userdebug_or_eng(` |
| # Read access to debugfs |
| allow storaged debugfs_mmc:dir search; |
| allow storaged debugfs_mmc:file r_file_perms; |
| ') |
| |
| # Needed to provide debug dump output via dumpsys pipes. |
| allow storaged shell:fd use; |
| allow storaged shell:fifo_file write; |
| |
| # Needed for GMScore to call dumpsys storaged |
| allow storaged priv_app:fd use; |
| allow storaged app_data_file:file write; |
| allow storaged permission_service:service_manager find; |
| |
| # Binder permissions |
| add_service(storaged, storaged_service) |
| |
| binder_use(storaged) |
| binder_call(storaged, system_server) |
| |
| # use batteryproperties service |
| allow storaged batteryproperties_service:service_manager find; |
| binder_call(storaged, healthd) |
| |
| # Kernel does extra check on CAP_DAC_OVERRIDE for libbinder when storaged is |
| # running as root. See b/35323867 #3. |
| dontaudit storaged self:capability dac_override; |
| |
| ### |
| ### neverallow |
| ### |
| neverallow storaged domain:process ptrace; |
| neverallow storaged self:capability_class_set *; |