Home | History | Annotate | Download | only in sepolicy 
      1 # dumpstate
      2 type dumpstate, domain, domain_deprecated, mlstrustedsubject;
      3 type dumpstate_exec, exec_type, file_type;
      4 
      5 init_daemon_domain(dumpstate)
      6 net_domain(dumpstate)
      7 binder_use(dumpstate)
      8 wakelock_use(dumpstate)
      9 
     10 # Allow setting process priority, protect from OOM killer, and dropping
     11 # privileges by switching UID / GID
     12 allow dumpstate self:capability { setuid setgid sys_resource };
     13 
     14 # Allow dumpstate to scan through /proc/pid for all processes
     15 r_dir_file(dumpstate, domain)
     16 
     17 allow dumpstate self:capability {
     18     # Send signals to processes
     19     kill
     20     # Run iptables
     21     net_raw
     22     net_admin
     23 };
     24 
     25 # Allow executing files on system, such as:
     26 #   /system/bin/toolbox
     27 #   /system/bin/logcat
     28 #   /system/bin/dumpsys
     29 allow dumpstate system_file:file execute_no_trans;
     30 allow dumpstate toolbox_exec:file rx_file_perms;
     31 
     32 # Create and write into /data/anr/
     33 allow dumpstate self:capability { dac_override chown fowner fsetid };
     34 allow dumpstate anr_data_file:dir rw_dir_perms;
     35 allow dumpstate anr_data_file:file create_file_perms;
     36 
     37 # Allow reading /data/system/uiderrors.txt
     38 # TODO: scope this down.
     39 allow dumpstate system_data_file:file r_file_perms;
     40 
     41 # Read dmesg
     42 allow dumpstate self:capability2 syslog;
     43 allow dumpstate kernel:system syslog_read;
     44 
     45 # Read /sys/fs/pstore/console-ramoops
     46 allow dumpstate pstorefs:dir r_dir_perms;
     47 allow dumpstate pstorefs:file r_file_perms;
     48 
     49 # Get process attributes
     50 allow dumpstate domain:process getattr;
     51 
     52 # Signal java processes to dump their stack
     53 allow dumpstate { appdomain autoplay_app system_server }:process signal;
     54 
     55 # Signal native processes to dump their stack.
     56 # This list comes from native_processes_to_dump in dumpstate/utils.c
     57 allow dumpstate {
     58   audioserver
     59   cameraserver
     60   drmserver
     61   inputflinger
     62   mediacodec
     63   mediadrmserver
     64   mediaextractor
     65   mediaserver
     66   sdcardd
     67   surfaceflinger
     68 }:process signal;
     69 # Ask debuggerd for the backtraces of these processes.
     70 allow dumpstate {
     71   audioserver
     72   cameraserver
     73   drmserver
     74   inputflinger
     75   mediacodec
     76   mediadrmserver
     77   mediaextractor
     78   mediaserver
     79   sdcardd
     80   surfaceflinger
     81 }:debuggerd dump_backtrace;
     82 
     83 # Execute and transition to the vdc domain
     84 domain_auto_trans(dumpstate, vdc_exec, vdc)
     85 
     86 # Vibrate the device after we're done collecting the bugreport
     87 # /sys/class/timed_output/vibrator/enable
     88 # TODO: create a new file class, instead of allowing write access to all of /sys
     89 allow dumpstate sysfs:file w_file_perms;
     90 
     91 # TODO: added to match above sysfs rule. Remove me?
     92 allow dumpstate sysfs_usb:file w_file_perms;
     93 
     94 # Other random bits of data we want to collect
     95 allow dumpstate qtaguid_proc:file r_file_perms;
     96 allow dumpstate debugfs:file r_file_perms;
     97 # df for /storage/emulated needs search
     98 allow dumpstate { storage_file block_device }:dir { search getattr };
     99 allow dumpstate fuse_device:chr_file getattr;
    100 allow dumpstate { dm_device cache_block_device }:blk_file getattr;
    101 
    102 # Allow dumpstate to make binder calls to any binder service
    103 binder_call(dumpstate, binderservicedomain)
    104 binder_call(dumpstate, { appdomain autoplay_app netd })
    105 
    106 
    107 # Reading /proc/PID/maps of other processes
    108 allow dumpstate self:capability sys_ptrace;
    109 
    110 # Allow the bugreport service to create a file in
    111 # /data/data/com.android.shell/files/bugreports/bugreport
    112 allow dumpstate shell_data_file:dir create_dir_perms;
    113 allow dumpstate shell_data_file:file create_file_perms;
    114 
    115 # Run a shell.
    116 allow dumpstate shell_exec:file rx_file_perms;
    117 
    118 # For running am and similar framework commands.
    119 # Run /system/bin/app_process.
    120 allow dumpstate zygote_exec:file rx_file_perms;
    121 # Dalvik Compiler JIT.
    122 allow dumpstate ashmem_device:chr_file execute;
    123 allow dumpstate dumpstate_tmpfs:file execute;
    124 allow dumpstate self:process execmem;
    125 # For art.
    126 allow dumpstate dalvikcache_data_file:file execute;
    127 allow dumpstate dalvikcache_data_file:lnk_file r_file_perms;
    128 
    129 # Dumpstate calls screencap, which grabs a screenshot. Needs gpu access
    130 allow dumpstate gpu_device:chr_file rw_file_perms;
    131 
    132 # logd access
    133 read_logd(dumpstate)
    134 control_logd(dumpstate)
    135 
    136 # Read network state info files.
    137 allow dumpstate net_data_file:dir search;
    138 allow dumpstate net_data_file:file r_file_perms;
    139 
    140 # List sockets via ss.
    141 allow dumpstate self:netlink_tcpdiag_socket { create_socket_perms nlmsg_read };
    142 
    143 # Access /data/tombstones.
    144 allow dumpstate tombstone_data_file:dir r_dir_perms;
    145 allow dumpstate tombstone_data_file:file r_file_perms;
    146 
    147 # Access /cache/recovery
    148 allow dumpstate cache_recovery_file:dir r_dir_perms;
    149 allow dumpstate cache_recovery_file:file r_file_perms;
    150 
    151 # Access /data/misc/recovery
    152 allow dumpstate recovery_data_file:dir r_dir_perms;
    153 allow dumpstate recovery_data_file:file r_file_perms;
    154 
    155 # Access /data/misc/profiles/{cur,ref}/
    156 userdebug_or_eng(`
    157   allow dumpstate user_profile_data_file:dir r_dir_perms;
    158   allow dumpstate user_profile_data_file:file r_file_perms;
    159   allow dumpstate user_profile_foreign_dex_data_file:dir r_dir_perms;
    160   allow dumpstate user_profile_foreign_dex_data_file:file r_file_perms;
    161 ')
    162 
    163 # Access /data/misc/logd
    164 userdebug_or_eng(`
    165   allow dumpstate misc_logd_file:dir r_dir_perms;
    166   allow dumpstate misc_logd_file:file r_file_perms;
    167 ')
    168 
    169 allow dumpstate { service_manager_type -gatekeeper_service }:service_manager find;
    170 allow dumpstate servicemanager:service_manager list;
    171 
    172 allow dumpstate devpts:chr_file rw_file_perms;
    173 
    174 # Set properties.
    175 # dumpstate_prop is used to share state with the Shell app.
    176 set_prop(dumpstate, dumpstate_prop)
    177 
    178 # systrace support - allow atrace to run
    179 allow dumpstate debugfs_tracing:dir r_dir_perms;
    180 allow dumpstate debugfs_tracing:file rw_file_perms;
    181 allow dumpstate debugfs_trace_marker:file getattr;
    182 allow dumpstate atrace_exec:file rx_file_perms;
    183 
    184 # Access to /data/media.
    185 # This should be removed if sdcardfs is modified to alter the secontext for its
    186 # accesses to the underlying FS.
    187 allow dumpstate media_rw_data_file:dir getattr;
    188