1 # perfprofd - perf profile collection daemon 2 type perfprofd_exec, exec_type, file_type; 3 4 userdebug_or_eng(` 5 6 type perfprofd, domain, mlstrustedsubject; 7 8 init_daemon_domain(perfprofd) 9 10 # perfprofd needs to control CPU hot-plug in order to avoid kernel 11 # perfevents problems in cases where CPU goes on/off during measurement; 12 # this means read access to /sys/devices/system/cpu/possible 13 # and read/write access to /sys/devices/system/cpu/cpu*/online 14 allow perfprofd sysfs_devices_system_cpu:file rw_file_perms; 15 16 # perfprofd checks for the existence of and then invokes simpleperf; 17 # simpleperf retains perfprofd domain after exec 18 allow perfprofd system_file:file rx_file_perms; 19 20 # perfprofd reads a config file from /data/data/com.google.android.gms/files 21 allow perfprofd app_data_file:file r_file_perms; 22 allow perfprofd app_data_file:dir search; 23 allow perfprofd self:capability { dac_override }; 24 25 # perfprofd opens a file for writing in /data/misc/perfprofd 26 allow perfprofd perfprofd_data_file:file create_file_perms; 27 allow perfprofd perfprofd_data_file:dir rw_dir_perms; 28 29 # perfprofd uses the system log 30 read_logd(perfprofd); 31 write_logd(perfprofd); 32 33 # perfprofd inspects /sys/power/wake_unlock 34 wakelock_use(perfprofd); 35 36 # simpleperf uses ioctl() to turn on kernel perf events measurements 37 allow perfprofd self:capability sys_admin; 38 39 # simpleperf needs to examine /proc to collect task/thread info 40 r_dir_file(perfprofd, domain) 41 42 # simpleperf needs to access /proc/<pid>/exec 43 allow perfprofd self:capability { sys_resource sys_ptrace }; 44 neverallow perfprofd domain:process ptrace; 45 46 # simpleperf needs open/read any file that turns up in a profile 47 # to see whether it has a build ID 48 allow perfprofd exec_type:file r_file_perms; 49 50 # simpleperf is going to execute "sleep" 51 allow perfprofd toolbox_exec:file x_file_perms; 52 53 # needed for simpleperf on some kernels 54 allow perfprofd self:capability ipc_lock; 55 56 ') 57
