diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil index 68d6b409e6e82643453399c3e1562e31ec45a479..bc31452d07faf7703860e25aa89b2e7a49dcc428 100644 --- a/private/compat/26.0/26.0.ignore.cil +++ b/private/compat/26.0/26.0.ignore.cil @@ -66,6 +66,7 @@ lowpan_service mediaextractor_update_service mediaprovider_tmpfs + mnt_vendor_file netd_stable_secret_prop network_watchlist_data_file network_watchlist_service diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil index 1eaf22a7d38f1fd58e2db569f3896c998132a01e..0571bfc7827d57cab5b49a3586386fbc1edc3a7f 100644 --- a/private/compat/27.0/27.0.ignore.cil +++ b/private/compat/27.0/27.0.ignore.cil @@ -54,6 +54,7 @@ lowpan_prop lowpan_service mediaextractor_update_service + mnt_vendor_file network_watchlist_data_file network_watchlist_service perfetto diff --git a/private/file_contexts b/private/file_contexts index 109f2190802573307ae0384dde8a132cc7588a51..4e2a7654b8678a61bfe7161d7208d33a1ccfabbd 100644 --- a/private/file_contexts +++ b/private/file_contexts @@ -525,3 +525,7 @@ /mnt/user(/.*)? u:object_r:mnt_user_file:s0 /mnt/runtime(/.*)? u:object_r:storage_file:s0 /storage(/.*)? u:object_r:storage_file:s0 + +############################# +# mount point for read-write vendor partitions +/mnt/vendor(/.*)? u:object_r:mnt_vendor_file:s0 diff --git a/public/domain.te b/public/domain.te index 0e815b60772d3921d8ae20e4b5a68f15eea67165..9458d796a199b312e33ab430e69d0a82f4ceb8cd 100644 --- a/public/domain.te +++ b/public/domain.te @@ -1363,3 +1363,9 @@ userdebug_or_eng(` dontaudit domain proc_type:file create; dontaudit domain sysfs_type:file create; ') + +# Platform must not have access to /mnt/vendor. +neverallow { + coredomain + -init +} mnt_vendor_file:dir *; diff --git a/public/file.te b/public/file.te index 5a5ee80baf55d5fb5c89d01012e3534e97398b11..01b489d71aea04479364c46de52e820819fa3c1b 100644 --- a/public/file.te +++ b/public/file.te @@ -225,6 +225,9 @@ type storage_file, file_type; type mnt_media_rw_stub_file, file_type; type storage_stub_file, file_type; +# Mount location for read-write vendor partitions. +type mnt_vendor_file, file_type; + # /postinstall: Mount point used by update_engine to run postinstall. type postinstall_mnt_dir, file_type; # Files inside the /postinstall mountpoint are all labeled as postinstall_file.