From 14e765cd711b2b6473f0c553a6f374818fe46293 Mon Sep 17 00:00:00 2001 From: codeworkx Date: Fri, 1 Jan 2016 17:29:10 +0100 Subject: [PATCH] cm: sepolicy: fix denials for external storage Change-Id: I784a859671c69370cab0118a88a5fb0190352af9 --- sepolicy/fsck_untrusted.te | 2 ++ sepolicy/genfs_contexts | 2 ++ sepolicy/system_server.te | 2 ++ sepolicy/vold.te | 5 +++++ 4 files changed, 11 insertions(+) create mode 100644 sepolicy/fsck_untrusted.te diff --git a/sepolicy/fsck_untrusted.te b/sepolicy/fsck_untrusted.te new file mode 100644 index 00000000..5d12f768 --- /dev/null +++ b/sepolicy/fsck_untrusted.te @@ -0,0 +1,2 @@ +# External storage +allow fsck_untrusted self:capability sys_admin; diff --git a/sepolicy/genfs_contexts b/sepolicy/genfs_contexts index cec9f01e..b39d3dda 100644 --- a/sepolicy/genfs_contexts +++ b/sepolicy/genfs_contexts @@ -1 +1,3 @@ genfscon fuseblk / u:object_r:sdcard_external:s0 +genfscon exfat / u:object_r:sdcard_external:s0 +genfscon ntfs / u:object_r:sdcard_external:s0 diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te index b6a65ee2..a9000b6a 100644 --- a/sepolicy/system_server.te +++ b/sepolicy/system_server.te @@ -4,3 +4,5 @@ allow system_server recovery_cache_file:file create_file_perms; # Persistent properties allow system_server persist_property_file:dir rw_dir_perms; allow system_server persist_property_file:file { create_file_perms unlink }; + +allow system_server storage_stub_file:dir { getattr }; diff --git a/sepolicy/vold.te b/sepolicy/vold.te index 9b7313c2..efca286b 100644 --- a/sepolicy/vold.te +++ b/sepolicy/vold.te @@ -14,3 +14,8 @@ allow vold self:capability { setgid setuid }; recovery_only(` allow vold rootfs:dir { add_name write }; ') + +# External storage +allow vold storage_stub_file:dir { rw_file_perms search add_name }; +allow vold mnt_media_rw_stub_file:dir r_dir_perms; +allow vold mkfs_exec:file { execute read open execute_no_trans };