diff options
| author | codeworkx <codeworkx@cyanogenmod.org> | 2016-01-01 17:29:10 +0100 |
|---|---|---|
| committer | codeworkx <codeworkx@cyanogenmod.org> | 2016-01-01 17:30:27 +0100 |
| commit | 14e765cd711b2b6473f0c553a6f374818fe46293 (patch) | |
| tree | 2d2e40dc9a2650bfcfd37b070dc1f6552f21d75b /sepolicy | |
| parent | 053b1805dacfe06e6a83411158c87644a0c35b00 (diff) | |
| download | vendor_replicant-14e765cd711b2b6473f0c553a6f374818fe46293.zip vendor_replicant-14e765cd711b2b6473f0c553a6f374818fe46293.tar.gz vendor_replicant-14e765cd711b2b6473f0c553a6f374818fe46293.tar.bz2 | |
cm: sepolicy: fix denials for external storage
Change-Id: I784a859671c69370cab0118a88a5fb0190352af9
Diffstat (limited to 'sepolicy')
| -rw-r--r-- | sepolicy/fsck_untrusted.te | 2 | ||||
| -rw-r--r-- | sepolicy/genfs_contexts | 2 | ||||
| -rw-r--r-- | sepolicy/system_server.te | 2 | ||||
| -rw-r--r-- | sepolicy/vold.te | 5 |
4 files changed, 11 insertions, 0 deletions
diff --git a/sepolicy/fsck_untrusted.te b/sepolicy/fsck_untrusted.te new file mode 100644 index 0000000..5d12f76 --- /dev/null +++ b/sepolicy/fsck_untrusted.te @@ -0,0 +1,2 @@ +# External storage +allow fsck_untrusted self:capability sys_admin; diff --git a/sepolicy/genfs_contexts b/sepolicy/genfs_contexts index cec9f01..b39d3dd 100644 --- a/sepolicy/genfs_contexts +++ b/sepolicy/genfs_contexts @@ -1 +1,3 @@ genfscon fuseblk / u:object_r:sdcard_external:s0 +genfscon exfat / u:object_r:sdcard_external:s0 +genfscon ntfs / u:object_r:sdcard_external:s0 diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te index b6a65ee..a9000b6 100644 --- a/sepolicy/system_server.te +++ b/sepolicy/system_server.te @@ -4,3 +4,5 @@ allow system_server recovery_cache_file:file create_file_perms; # Persistent properties allow system_server persist_property_file:dir rw_dir_perms; allow system_server persist_property_file:file { create_file_perms unlink }; + +allow system_server storage_stub_file:dir { getattr }; diff --git a/sepolicy/vold.te b/sepolicy/vold.te index 9b7313c..efca286 100644 --- a/sepolicy/vold.te +++ b/sepolicy/vold.te @@ -14,3 +14,8 @@ allow vold self:capability { setgid setuid }; recovery_only(` allow vold rootfs:dir { add_name write }; ') + +# External storage +allow vold storage_stub_file:dir { rw_file_perms search add_name }; +allow vold mnt_media_rw_stub_file:dir r_dir_perms; +allow vold mkfs_exec:file { execute read open execute_no_trans }; |