Home | History | Annotate | Download | only in sepolicy 
      1 # dumpstate
      2 type dumpstate, domain, domain_deprecated, mlstrustedsubject;
      3 type dumpstate_exec, exec_type, file_type;
      4 
      5 init_daemon_domain(dumpstate)
      6 net_domain(dumpstate)
      7 binder_use(dumpstate)
      8 
      9 # Allow setting process priority, protect from OOM killer, and dropping
     10 # privileges by switching UID / GID
     11 allow dumpstate self:capability { setuid setgid sys_resource };
     12 
     13 # Allow dumpstate to scan through /proc/pid for all processes
     14 r_dir_file(dumpstate, domain)
     15 
     16 allow dumpstate self:capability {
     17     # Send signals to processes
     18     kill
     19     # Run iptables
     20     net_raw
     21     net_admin
     22 };
     23 
     24 # Allow executing files on system, such as:
     25 #   /system/bin/toolbox
     26 #   /system/bin/logcat
     27 #   /system/bin/dumpsys
     28 allow dumpstate system_file:file execute_no_trans;
     29 allow dumpstate toolbox_exec:file rx_file_perms;
     30 
     31 # Create and write into /data/anr/
     32 allow dumpstate self:capability { dac_override chown fowner fsetid };
     33 allow dumpstate anr_data_file:dir rw_dir_perms;
     34 allow dumpstate anr_data_file:file create_file_perms;
     35 
     36 # Allow reading /data/system/uiderrors.txt
     37 # TODO: scope this down.
     38 allow dumpstate system_data_file:file r_file_perms;
     39 
     40 # Read dmesg
     41 allow dumpstate self:capability2 syslog;
     42 allow dumpstate kernel:system syslog_read;
     43 
     44 # Read /sys/fs/pstore/console-ramoops
     45 allow dumpstate pstorefs:dir r_dir_perms;
     46 allow dumpstate pstorefs:file r_file_perms;
     47 
     48 # Get process attributes
     49 allow dumpstate domain:process getattr;
     50 
     51 # Signal java processes to dump their stack
     52 allow dumpstate { appdomain autoplay_app system_server }:process signal;
     53 
     54 # Signal native processes to dump their stack.
     55 # This list comes from native_processes_to_dump in dumpstate/utils.c
     56 allow dumpstate {
     57   audioserver
     58   cameraserver
     59   drmserver
     60   inputflinger
     61   mediacodec
     62   mediadrmserver
     63   mediaextractor
     64   mediaserver
     65   sdcardd
     66   surfaceflinger
     67 }:process signal;
     68 # Ask debuggerd for the backtraces of these processes.
     69 allow dumpstate {
     70   audioserver
     71   cameraserver
     72   drmserver
     73   inputflinger
     74   mediacodec
     75   mediadrmserver
     76   mediaextractor
     77   mediaserver
     78   sdcardd
     79   surfaceflinger
     80 }:debuggerd dump_backtrace;
     81 
     82 # Execute and transition to the vdc domain
     83 domain_auto_trans(dumpstate, vdc_exec, vdc)
     84 
     85 # Vibrate the device after we're done collecting the bugreport
     86 # /sys/class/timed_output/vibrator/enable
     87 # TODO: create a new file class, instead of allowing write access to all of /sys
     88 allow dumpstate sysfs:file w_file_perms;
     89 
     90 # TODO: added to match above sysfs rule. Remove me?
     91 allow dumpstate sysfs_usb:file w_file_perms;
     92 
     93 # Other random bits of data we want to collect
     94 allow dumpstate qtaguid_proc:file r_file_perms;
     95 allow dumpstate debugfs:file r_file_perms;
     96 # df for /storage/emulated needs search
     97 allow dumpstate { storage_file block_device }:dir { search getattr };
     98 allow dumpstate fuse_device:chr_file getattr;
     99 allow dumpstate { dm_device cache_block_device }:blk_file getattr;
    100 
    101 # Allow dumpstate to make binder calls to any binder service
    102 binder_call(dumpstate, binderservicedomain)
    103 binder_call(dumpstate, { appdomain autoplay_app netd })
    104 
    105 
    106 # Reading /proc/PID/maps of other processes
    107 allow dumpstate self:capability sys_ptrace;
    108 
    109 # Allow the bugreport service to create a file in
    110 # /data/data/com.android.shell/files/bugreports/bugreport
    111 allow dumpstate shell_data_file:dir create_dir_perms;
    112 allow dumpstate shell_data_file:file create_file_perms;
    113 
    114 # Run a shell.
    115 allow dumpstate shell_exec:file rx_file_perms;
    116 
    117 # For running am and similar framework commands.
    118 # Run /system/bin/app_process.
    119 allow dumpstate zygote_exec:file rx_file_perms;
    120 # Dalvik Compiler JIT.
    121 allow dumpstate ashmem_device:chr_file execute;
    122 allow dumpstate dumpstate_tmpfs:file execute;
    123 allow dumpstate self:process execmem;
    124 # For art.
    125 allow dumpstate dalvikcache_data_file:file execute;
    126 allow dumpstate dalvikcache_data_file:lnk_file r_file_perms;
    127 
    128 # Dumpstate calls screencap, which grabs a screenshot. Needs gpu access
    129 allow dumpstate gpu_device:chr_file rw_file_perms;
    130 
    131 # logd access
    132 read_logd(dumpstate)
    133 control_logd(dumpstate)
    134 
    135 # Read network state info files.
    136 allow dumpstate net_data_file:dir search;
    137 allow dumpstate net_data_file:file r_file_perms;
    138 
    139 # Access /data/tombstones.
    140 allow dumpstate tombstone_data_file:dir r_dir_perms;
    141 allow dumpstate tombstone_data_file:file r_file_perms;
    142 
    143 # Access /cache/recovery
    144 allow dumpstate cache_recovery_file:dir r_dir_perms;
    145 allow dumpstate cache_recovery_file:file r_file_perms;
    146 
    147 # Access /data/misc/recovery
    148 allow dumpstate recovery_data_file:dir r_dir_perms;
    149 allow dumpstate recovery_data_file:file r_file_perms;
    150 
    151 # Access /data/misc/profiles/{cur,ref}/
    152 userdebug_or_eng(`
    153   allow dumpstate user_profile_data_file:dir r_dir_perms;
    154   allow dumpstate user_profile_data_file:file r_file_perms;
    155   allow dumpstate user_profile_foreign_dex_data_file:dir r_dir_perms;
    156   allow dumpstate user_profile_foreign_dex_data_file:file r_file_perms;
    157 ')
    158 
    159 # Access /data/misc/logd
    160 userdebug_or_eng(`
    161   allow dumpstate misc_logd_file:dir r_dir_perms;
    162   allow dumpstate misc_logd_file:file r_file_perms;
    163 ')
    164 
    165 allow dumpstate { service_manager_type -gatekeeper_service }:service_manager find;
    166 allow dumpstate servicemanager:service_manager list;
    167 
    168 allow dumpstate devpts:chr_file rw_file_perms;
    169 
    170 # Set properties.
    171 # dumpstate_prop is used to share state with the Shell app.
    172 set_prop(dumpstate, dumpstate_prop)
    173 
    174 # systrace support - allow atrace to run
    175 allow dumpstate debugfs_tracing:dir r_dir_perms;
    176 allow dumpstate debugfs_tracing:file rw_file_perms;
    177 allow dumpstate debugfs_trace_marker:file getattr;
    178 allow dumpstate atrace_exec:file rx_file_perms;
    179 
    180 # Access to /data/media.
    181 # This should be removed if sdcardfs is modified to alter the secontext for its
    182 # accesses to the underlying FS.
    183 allow dumpstate media_rw_data_file:dir getattr;
    184