| ###################################### |
| # Attribute declarations |
| # |
| |
| # All types used for devices. |
| # On change, update CHECK_FC_ASSERT_ATTRS |
| # in tools/checkfc.c |
| attribute dev_type; |
| |
| # All types used for processes. |
| attribute domain; |
| |
| # All types used for filesystems. |
| # On change, update CHECK_FC_ASSERT_ATTRS |
| # definition in tools/checkfc.c. |
| attribute fs_type; |
| |
| # All types used for context= mounts. |
| attribute contextmount_type; |
| |
| # All types used for files that can exist on a labeled fs. |
| # Do not use for pseudo file types. |
| # On change, update CHECK_FC_ASSERT_ATTRS |
| # definition in tools/checkfc.c. |
| attribute file_type; |
| |
| # All types used for domain entry points. |
| attribute exec_type; |
| |
| # All types used for /data files. |
| attribute data_file_type; |
| expandattribute data_file_type false; |
| # All types in /data, not in /data/vendor |
| attribute core_data_file_type; |
| expandattribute core_data_file_type false; |
| # All types in /vendor |
| attribute vendor_file_type; |
| |
| # All types used for procfs files. |
| attribute proc_type; |
| expandattribute proc_type false; |
| |
| # Types in /proc/net, excluding qtaguid types. |
| # TODO(b/9496886) Lock down access to /proc/net. |
| # This attribute is used to audit access to proc_net. it is temporary and will |
| # be removed. |
| attribute proc_net_type; |
| expandattribute proc_net_type true; |
| |
| # All types used for sysfs files. |
| attribute sysfs_type; |
| |
| # All types use for debugfs files. |
| attribute debugfs_type; |
| |
| # Attribute used for all sdcards |
| attribute sdcard_type; |
| |
| # All types used for nodes/hosts. |
| attribute node_type; |
| |
| # All types used for network interfaces. |
| attribute netif_type; |
| |
| # All types used for network ports. |
| attribute port_type; |
| |
| # All types used for property service |
| # On change, update CHECK_PC_ASSERT_ATTRS |
| # definition in tools/checkfc.c. |
| attribute property_type; |
| |
| # All properties defined in core SELinux policy. Should not be |
| # used by device specific properties |
| attribute core_property_type; |
| |
| # All properties used to configure log filtering. |
| attribute log_property_type; |
| |
| # All service_manager types created by system_server |
| attribute system_server_service; |
| |
| # services which should be available to all but isolated apps |
| attribute app_api_service; |
| |
| # services which should be available to all ephemeral apps |
| attribute ephemeral_app_api_service; |
| |
| # services which export only system_api |
| attribute system_api_service; |
| |
| # All types used for services managed by servicemanager. |
| # On change, update CHECK_SC_ASSERT_ATTRS |
| # definition in tools/checkfc.c. |
| attribute service_manager_type; |
| |
| # All types used for services managed by hwservicemanager |
| attribute hwservice_manager_type; |
| |
| # All HwBinder services guaranteed to be passthrough. These services always run |
| # in the process of their clients, and thus operate with the same access as |
| # their clients. |
| attribute same_process_hwservice; |
| |
| # All HwBinder services guaranteed to be offered only by core domain components |
| attribute coredomain_hwservice; |
| |
| # All types used for services managed by vndservicemanager |
| attribute vndservice_manager_type; |
| |
| |
| # All domains that can override MLS restrictions. |
| # i.e. processes that can read up and write down. |
| attribute mlstrustedsubject; |
| |
| # All types that can override MLS restrictions. |
| # i.e. files that can be read by lower and written by higher |
| attribute mlstrustedobject; |
| |
| # All domains used for apps. |
| attribute appdomain; |
| |
| # All third party apps. |
| attribute untrusted_app_all; |
| |
| # All domains used for apps with network access. |
| attribute netdomain; |
| |
| # All domains used for apps with bluetooth access. |
| attribute bluetoothdomain; |
| |
| # All domains used for binder service domains. |
| attribute binderservicedomain; |
| |
| # update_engine related domains that need to apply an update and run |
| # postinstall. This includes the background daemon and the sideload tool from |
| # recovery for A/B devices. |
| attribute update_engine_common; |
| |
| # All core domains (as opposed to vendor/device-specific domains) |
| attribute coredomain; |
| |
| # All socket devices owned by core domain components |
| attribute coredomain_socket; |
| expandattribute coredomain_socket false; |
| |