sepolicy/init.te

   1 # Mount debugfs on /sys/kernel/debug.
   2 allow init debugfs:dir mounton;
   3
   4 # Mount EFS on /efs
   5 allow init efs_file:dir  mounton;
   6
   7 # Mount CPEFS on /cpefs
   8 allow init sec_efs_file:dir mounton;
   9
  10 # Allow init to bind mount over system files
  11 allow init system_file:file mounton;
  12
  13 # /dev/block/mmcblk0p[0-9]
  14 allow init emmcblk_device:blk_file rw_file_perms;
  15
  16 allow init block_device:lnk_file setattr;
  17 allow init tmpfs:lnk_file create_file_perms;
  18
  19 # /sys/class/power_supply/battery and /sys/class/android_usb/android0
  20 allow init sysfs_usb_supply:file { rw_file_perms setattr };
  21
  22 # /data
  23 allow init sdcardd_exec:file r_file_perms;
  24
  25 # sysfs iio:device[0-9]
  26 allow init sysfs:lnk_file setattr;
  27
  28 # sysfs ion device
  29 allow init sysfs_ion:file setattr;
  30
  31 # sysfs usb device
  32 allow init sysfs_android_usb:file setattr;
  33
  34 # read/chown mDNIE symlinks
  35 allow init sysfs_mdnie:lnk_file { r_file_perms setattr };
  36 allow init sysfs_mdnie:file rw_file_perms;
  37
  38 # read/chown camera firmware
  39 allow init sysfs_camera:file { relabelto setattr };
  40 allow init sysfs_camera:filesystem associate;
  41
  42 # WiFi firmware permissions
  43 allow init sysfs_wifi:file setattr;
  44
  45 # Input devices
  46 allow init sysfs_input:file { rw_file_perms setattr };
  47
  48 # BT permissions
  49 allow init sysfs_bluetooth_writable:file setattr;
  50
  51 # GPS permissions
  52 allow init sysfs_gps:lnk_file read;
  53 allow init sysfs_gps:file { rw_file_perms setattr };
  54 allow init gps_data_file:fifo_file write;
  55 allow init gps_data_file:file lock;
  56 allow init gps_device:chr_file { open read write };
  57
  58 # CPU permissions
  59 allow init sysfs_devices_system_cpu:file rw_file_perms;
  60
  61 # umts permissions
  62 allow init mif_device:chr_file rw_file_perms;
  63
  64 # sswap permissions
  65 allow init sswap_device:blk_file write;
  66 allow init sysfs_sswap:file { open write };
  67
  68 # Block device sysfs
  69 allow init sysfs_block:file rw_file_perms;
  70
  71 # Audio Jack
  72 allow init sysfs_jack:file setattr;
  73
  74 unix_socket_connect(init, property, rild)
  75
  76 # Allow access to /proc/device-tree nodes
  77 r_dir_file(init, proc_dt_firmware)
  78
  79 allow init sysfs_mmc:file { w_file_perms setattr };
  80 allow init sysfs_net:file rw_file_perms;
  81 allow init sysfs_graphics:file { rw_file_perms setattr };
  82 allow init sysfs_light:file { rw_file_perms setattr };
  83 allow init sysfs_light:lnk_file { rw_file_perms setattr };
  84 allow init sysfs_mdnie:file setattr;
  85 allow init sysfs_sec:file { rw_file_perms setattr };
  86 allow init sysfs_sec:lnk_file read;
  87 allow init sysfs_sensors:file { rw_file_perms setattr };
  88 allow init sysfs_sensors:lnk_file read;
  89 allow init sysfs_multipdp:file setattr;
  90
  91 # Proc files
  92 allow init proc_reset_reason:file { rw_file_perms setattr };
  93 allow init proc_vm:file rw_file_perms;
  94 allow init proc_simslot_count:file rw_file_perms;
  95 allow init proc_sec:file { rw_file_perms setattr };
  96
  97 # Sockets
  98 allow init socket_device:sock_file { read write getattr setattr create unlink };