1typeattribute vold coredomain;
2
3init_daemon_domain(vold)
4
5# Switch to more restrictive domains when executing common tools
6domain_auto_trans(vold, sgdisk_exec, sgdisk);
7domain_auto_trans(vold, sdcardd_exec, sdcardd);
8
9# For a handful of probing tools, we choose an even more restrictive
10# domain when working with untrusted block devices
11domain_trans(vold, blkid_exec, blkid);
12domain_trans(vold, blkid_exec, blkid_untrusted);
13domain_trans(vold, fsck_exec, fsck);
14domain_trans(vold, fsck_exec, fsck_untrusted);
15
16# Newly created storage dirs are always treated as mount stubs to prevent us
17# from accidentally writing when the mount point isn't present.
18type_transition vold storage_file:dir storage_stub_file;
19type_transition vold mnt_media_rw_file:dir mnt_media_rw_stub_file;
20
21# Property Service
22get_prop(vold, vold_config_prop)
23get_prop(vold, storage_config_prop);
24get_prop(vold, incremental_prop);
25
26set_prop(vold, vold_post_fs_data_prop)
27set_prop(vold, vold_prop)
28set_prop(vold, vold_status_prop)
29set_prop(vold, powerctl_prop)
30set_prop(vold, ctl_fuse_prop)
31set_prop(vold, restorecon_prop)
32set_prop(vold, ota_prop)
33set_prop(vold, boottime_prop)
34set_prop(vold, boottime_public_prop)
35
36# Vold will use Keystore instead of using Keymint directly. But it still needs
37# to manage its Keymint blobs. This is why it needs the `manage_blob` permission.
38allow vold vold_key:keystore2_key {
39    convert_storage_key_to_ephemeral
40    delete
41    get_info
42    manage_blob
43    rebind
44    req_forced_op
45    update
46    use
47};
48
49# vold needs to call keystore methods
50allow vold keystore:binder call;
51
52# vold needs to find keystore2 services
53allow vold keystore_service:service_manager find;
54allow vold keystore_maintenance_service:service_manager find;
55
56# vold needs to be able to call earlyBootEnded() and deleteAllKeys()
57allow vold keystore:keystore2 early_boot_ended;
58allow vold keystore:keystore2 delete_all_keys;
59
60neverallow {
61    domain
62    -system_server
63    -vdc
64    -vold
65    -update_verifier
66    -apexd
67    -gsid
68} vold_service:service_manager find;
69