| # remote storage process (runs as nobody) |
| type rmt, domain, domain_deprecated; |
| type rmt_exec, exec_type, file_type; |
| |
| # Started by init |
| init_daemon_domain(rmt) |
| |
| # Drop (user, group) to (nobody, nobody) |
| allow rmt self:capability { setuid setgid dac_override setpcap net_raw }; |
| |
| # opens and reads /dev/block/mmcblk0 |
| allow rmt root_block_device:blk_file r_file_perms; |
| |
| # Allow reads/writes to modem related block devices |
| allow rmt modem_block_device:blk_file rw_file_perms; |
| allow rmt block_device:dir r_dir_perms; |
| allow rmt cgroup:dir { create add_name }; |
| allow rmt smem_log_device:chr_file rw_file_perms; |
| |
| # Needed for ioprio_set(IOPRIO_WHO_PROCESS, 0, IOPRIO_CLASS_RT << IOPRIO_CLASS_SHIFT); |
| allow rmt self:capability sys_admin; |
| |
| allow rmt ssd_block_device:blk_file rw_file_perms; |
| |
| allow rmt self:socket create_socket_perms; |
| |
| # Wake lock access |
| wakelock_use(rmt) |
| |
| # Allow access to /dev/uio0. |
| allow rmt uio_device:chr_file rw_file_perms; |
| |
| allow rmt mmc_block_device:blk_file r_file_perms; |