1 # dumpstate 2 type dumpstate, domain; 3 type dumpstate_exec, exec_type, file_type; 4 5 init_daemon_domain(dumpstate) 6 net_domain(dumpstate) 7 binder_use(dumpstate) 8 9 # Drop privileges by switching UID / GID 10 allow dumpstate self:capability { setuid setgid }; 11 12 # Allow dumpstate to scan through /proc/pid for all processes 13 r_dir_file(dumpstate, domain) 14 15 # Send signals to processes 16 allow dumpstate self:capability kill; 17 18 # Allow executing files on system, such as: 19 # /system/bin/toolbox 20 # /system/bin/logcat 21 # /system/bin/dumpsys 22 allow dumpstate system_file:file execute_no_trans; 23 24 # Create and write into /data/anr/ 25 allow dumpstate self:capability { dac_override chown fowner fsetid }; 26 allow dumpstate anr_data_file:dir { rw_dir_perms relabelto }; 27 allow dumpstate anr_data_file:file create_file_perms; 28 allow dumpstate system_data_file:dir { create_dir_perms relabelfrom }; 29 30 # Allow reading /data/system/uiderrors.txt 31 # TODO: scope this down. 32 allow dumpstate system_data_file:file r_file_perms; 33 34 # Read dmesg 35 allow dumpstate self:capability2 syslog; 36 allow dumpstate kernel:system syslog_read; 37 38 # Read /sys/fs/pstore/console-ramoops 39 allow dumpstate pstorefs:dir r_dir_perms; 40 allow dumpstate pstorefs:file r_file_perms; 41 42 # Get process attributes 43 allow dumpstate domain:process getattr; 44 45 # Signal java processes to dump their stack 46 allow dumpstate { appdomain system_server }:process signal; 47 48 # Signal native processes to dump their stack. 49 # This list comes from native_processes_to_dump in dumpstate/utils.c 50 allow dumpstate { drmserver mediaserver sdcardd surfaceflinger }:process signal; 51 52 # Execute and transition to the vdc domain 53 domain_auto_trans(dumpstate, vdc_exec, vdc) 54 55 # Vibrate the device after we're done collecting the bugreport 56 # /sys/class/timed_output/vibrator/enable 57 # TODO: create a new file class, instead of allowing write access to all of /sys 58 allow dumpstate sysfs:file w_file_perms; 59 60 # Other random bits of data we want to collect 61 allow dumpstate qtaguid_proc:file r_file_perms; 62 allow dumpstate debugfs:file r_file_perms; 63 64 # Allow dumpstate to make binder calls to any binder service 65 binder_call(dumpstate, binderservicedomain) 66 binder_call(dumpstate, appdomain) 67 68 # Reading /proc/PID/maps of other processes 69 allow dumpstate self:capability sys_ptrace; 70 71 # Allow the bugreport service to create a file in 72 # /data/data/com.android.shell/files/bugreports/bugreport 73 allow dumpstate shell_data_file:dir create_dir_perms; 74 allow dumpstate shell_data_file:file create_file_perms; 75 76 # Run a shell. 77 allow dumpstate shell_exec:file rx_file_perms; 78 79 # For running am and similar framework commands. 80 # Run /system/bin/app_process. 81 allow dumpstate zygote_exec:file rx_file_perms; 82 # Dalvik Compiler JIT. 83 allow dumpstate ashmem_device:chr_file execute; 84 allow dumpstate dumpstate_tmpfs:file execute; 85 allow dumpstate self:process execmem; 86 # For art. 87 allow dumpstate dalvikcache_data_file:file execute; 88 89 # Dumpstate calls screencap, which grabs a screenshot. Needs gpu access 90 allow dumpstate gpu_device:chr_file rw_file_perms; 91 92 # logd access 93 read_logd(dumpstate) 94 control_logd(dumpstate) 95 96 # Read network state info files. 97 allow dumpstate net_data_file:dir search; 98 allow dumpstate net_data_file:file r_file_perms; 99 100 # Access /data/tombstones. 101 allow dumpstate tombstone_data_file:dir r_dir_perms; 102 allow dumpstate tombstone_data_file:file r_file_perms; 103 104 # Access /system/bin executables to determine type of executable. 105 allow dumpstate {drmserver_exec mediaserver_exec sdcardd_exec surfaceflinger_exec}:file r_file_perms; 106
