1# encryptedstore is a program that provides (encrypted) storage solution in a VM based on dm-crypt 2 3type encryptedstore, domain, coredomain; 4type encryptedstore_exec, exec_type, file_type, system_file_type; 5 6# encryptedstore is using bootstrap bionic 7use_bootstrap_libs(encryptedstore) 8 9# encryptedstore require access to block device directory to map dm-crypt 10r_dir_file(encryptedstore, block_device) 11 12# encryptedstore accesses /dev/vd* block device file. 13allow encryptedstore vd_device:blk_file rw_file_perms; 14 15# allow encryptedstore to create dm-crypt devices 16allow encryptedstore dm_device:{ chr_file blk_file } rw_file_perms; 17 18# sys_admin is required to access the device-mapper and mount 19allow encryptedstore self:global_capability_class_set sys_admin; 20 21# encryptedstore is forked from microdroid_manager 22allow encryptedstore microdroid_manager:fd use; 23 24# For formatting encrypted storage device 25allow encryptedstore e2fs_exec:file { rx_file_perms }; 26allowxperm encryptedstore dm_device:blk_file ioctl { 27 BLKPBSZGET BLKDISCARDZEROES BLKROGET BLKDISCARD 28}; 29 30# access /sys/fs/ext4/features - required because encryptedstore runs mkfs.ext4 in its own domain 31allow encryptedstore sysfs_fs_ext4_features:dir search; 32allow encryptedstore sysfs_fs_ext4_features:file r_file_perms; 33 34# encryptedstore to mount on tmpfs bases directory (/mnt/) 35allow encryptedstore tmpfs:dir { add_name create mounton write }; 36 37# encryptedstore relabels the labeledfs to encryptedstore_fs, then mounts on the latter 38allow encryptedstore labeledfs:filesystem { relabelfrom }; 39allow encryptedstore encryptedstore_fs:filesystem { mount unmount relabelto relabelfrom }; 40 41# chmod the root directory 42allow encryptedstore encryptedstore_file:dir setattr; 43 44# allow encryptedstore to log to the kernel 45allow encryptedstore kmsg_device:chr_file w_file_perms; 46 47# Allow encryptedstore to write kmsg_debug (stdio_to_kmsg). 48allow encryptedstore kmsg_debug_device:chr_file w_file_perms; 49 50# Only microdroid_manager can run encryptedstore 51neverallow { domain -microdroid_manager } encryptedstore:process { transition dyntransition }; 52