Home | History | Annotate | Download | only in sepolicy 
      1 # dumpstate
      2 type dumpstate, domain, mlstrustedsubject;
      3 type dumpstate_exec, exec_type, file_type;
      4 
      5 init_daemon_domain(dumpstate)
      6 net_domain(dumpstate)
      7 binder_use(dumpstate)
      8 
      9 # Allow setting process priority, protect from OOM killer, and dropping
     10 # privileges by switching UID / GID
     11 allow dumpstate self:capability { setuid setgid sys_resource };
     12 
     13 # Allow dumpstate to scan through /proc/pid for all processes
     14 r_dir_file(dumpstate, domain)
     15 
     16 # Send signals to processes
     17 allow dumpstate self:capability kill;
     18 
     19 # Allow executing files on system, such as:
     20 #   /system/bin/toolbox
     21 #   /system/bin/logcat
     22 #   /system/bin/dumpsys
     23 allow dumpstate system_file:file execute_no_trans;
     24 
     25 # Create and write into /data/anr/
     26 allow dumpstate self:capability { dac_override chown fowner fsetid };
     27 allow dumpstate anr_data_file:dir { rw_dir_perms relabelto };
     28 allow dumpstate anr_data_file:file create_file_perms;
     29 allow dumpstate system_data_file:dir { create_dir_perms relabelfrom };
     30 
     31 # Allow reading /data/system/uiderrors.txt
     32 # TODO: scope this down.
     33 allow dumpstate system_data_file:file r_file_perms;
     34 
     35 # Read dmesg
     36 allow dumpstate self:capability2 syslog;
     37 allow dumpstate kernel:system syslog_read;
     38 
     39 # Read /sys/fs/pstore/console-ramoops
     40 allow dumpstate pstorefs:dir r_dir_perms;
     41 allow dumpstate pstorefs:file r_file_perms;
     42 
     43 # Get process attributes
     44 allow dumpstate domain:process getattr;
     45 
     46 # Signal java processes to dump their stack
     47 allow dumpstate { appdomain system_server }:process signal;
     48 
     49 # Signal native processes to dump their stack.
     50 # This list comes from native_processes_to_dump in dumpstate/utils.c
     51 allow dumpstate { drmserver mediaserver sdcardd surfaceflinger }:process signal;
     52 # Ask debuggerd for the backtraces of these processes.
     53 allow dumpstate { drmserver mediaserver sdcardd surfaceflinger }:debuggerd dump_backtrace;
     54 
     55 # Execute and transition to the vdc domain
     56 domain_auto_trans(dumpstate, vdc_exec, vdc)
     57 
     58 # Vibrate the device after we're done collecting the bugreport
     59 # /sys/class/timed_output/vibrator/enable
     60 # TODO: create a new file class, instead of allowing write access to all of /sys
     61 allow dumpstate sysfs:file w_file_perms;
     62 
     63 # Other random bits of data we want to collect
     64 allow dumpstate qtaguid_proc:file r_file_perms;
     65 allow dumpstate debugfs:file r_file_perms;
     66 # df for /storage/emulated needs search
     67 allow dumpstate storage_file:dir search;
     68 
     69 # Allow dumpstate to make binder calls to any binder service
     70 binder_call(dumpstate, binderservicedomain)
     71 binder_call(dumpstate, appdomain)
     72 
     73 # Reading /proc/PID/maps of other processes
     74 allow dumpstate self:capability sys_ptrace;
     75 
     76 # Allow the bugreport service to create a file in
     77 # /data/data/com.android.shell/files/bugreports/bugreport
     78 allow dumpstate shell_data_file:dir create_dir_perms;
     79 allow dumpstate shell_data_file:file create_file_perms;
     80 
     81 # Run a shell.
     82 allow dumpstate shell_exec:file rx_file_perms;
     83 
     84 # For running am and similar framework commands.
     85 # Run /system/bin/app_process.
     86 allow dumpstate zygote_exec:file rx_file_perms;
     87 # Dalvik Compiler JIT.
     88 allow dumpstate ashmem_device:chr_file execute;
     89 allow dumpstate dumpstate_tmpfs:file execute;
     90 allow dumpstate self:process execmem;
     91 # For art.
     92 allow dumpstate dalvikcache_data_file:file execute;
     93 allow dumpstate dalvikcache_data_file:lnk_file r_file_perms;
     94 
     95 # Dumpstate calls screencap, which grabs a screenshot. Needs gpu access
     96 allow dumpstate gpu_device:chr_file rw_file_perms;
     97 
     98 # logd access
     99 read_logd(dumpstate)
    100 control_logd(dumpstate)
    101 
    102 # Read network state info files.
    103 allow dumpstate net_data_file:dir search;
    104 allow dumpstate net_data_file:file r_file_perms;
    105 
    106 # Access /data/tombstones.
    107 allow dumpstate tombstone_data_file:dir r_dir_perms;
    108 allow dumpstate tombstone_data_file:file r_file_perms;
    109 
    110 allow dumpstate { service_manager_type -gatekeeper_service }:service_manager find;
    111 allow dumpstate servicemanager:service_manager list;
    112 
    113 allow dumpstate devpts:chr_file rw_file_perms;
    114