Merge "system_server: neverallow blk_file read/write"
diff --git a/neverallow_macros b/neverallow_macros
index 3593dd1..b36cceb 100644
--- a/neverallow_macros
+++ b/neverallow_macros
@@ -1,5 +1,6 @@
#
# Common neverallow permissions
define(`no_w_file_perms', `{ append create link unlink relabelfrom rename setattr write }')
+define(`no_rw_file_perms', `{ no_w_file_perms open read ioctl lock }')
define(`no_x_file_perms', `{ execute execute_no_trans }')
define(`no_w_dir_perms', `{ add_name create link relabelfrom remove_name rename reparent rmdir setattr write }')
diff --git a/system_server.te b/system_server.te
index ee3aa89..6630615 100644
--- a/system_server.te
+++ b/system_server.te
@@ -492,3 +492,8 @@
# system server to dynamically load a dex file, something we do not
# want to allow.
neverallow system_server dex2oat_exec:file no_x_file_perms;
+
+# The only block device system_server should be accessing is
+# the frp_block_device. This helps avoid a system_server to root
+# escalation by writing to raw block devices.
+neverallow system_server { dev_type -frp_block_device }:blk_file no_rw_file_perms;
