Home | History | Annotate | Download | only in private 
      1 typeattribute incidentd coredomain;
      2 
      3 init_daemon_domain(incidentd)
      4 type incidentd_exec, exec_type, file_type;
      5 binder_use(incidentd)
      6 wakelock_use(incidentd)
      7 
      8 # Allow setting process priority, protect from OOM killer, and dropping
      9 # privileges by switching UID / GID
     10 # TODO allow incidentd self:capability { setuid setgid sys_resource };
     11 
     12 # Allow incidentd to scan through /proc/pid for all processes
     13 r_dir_file(incidentd, domain)
     14 
     15 allow incidentd self:capability {
     16     # Send signals to processes
     17     kill
     18 };
     19 
     20 # Allow executing files on system, such as:
     21 #   /system/bin/toolbox
     22 #   /system/bin/logcat
     23 #   /system/bin/dumpsys
     24 allow incidentd system_file:file execute_no_trans;
     25 allow incidentd toolbox_exec:file rx_file_perms;
     26 
     27 # Create and write into /data/misc/incidents
     28 allow incidentd incident_data_file:dir rw_dir_perms;
     29 allow incidentd incident_data_file:file create_file_perms;
     30 
     31 # Get process attributes
     32 # TODO allow incidentd domain:process getattr;
     33 
     34 # Signal java processes to dump their stack and get the results
     35 # TODO allow incidentd { appdomain ephemeral_app system_server }:process signal;
     36 # TODO allow incidentd anr_data_file:dir rw_dir_perms;
     37 # TODO allow incidentd anr_data_file:file create_file_perms;
     38 
     39 # Signal native processes to dump their stack.
     40 # This list comes from native_processes_to_dump in incidentd/utils.c
     41 allow incidentd {
     42   audioserver
     43   cameraserver
     44   drmserver
     45   inputflinger
     46   mediacodec
     47   mediadrmserver
     48   mediaextractor
     49   mediaserver
     50   sdcardd
     51   surfaceflinger
     52 }:process signal;
     53 
     54 # Allow incidentd to make binder calls to any binder service
     55 binder_call(incidentd, binderservicedomain)
     56 binder_call(incidentd, appdomain)
     57 
     58 # Reading /proc/PID/maps of other processes
     59 # TODO allow incidentd self:capability sys_ptrace;
     60 
     61 # Run a shell.
     62 allow incidentd shell_exec:file rx_file_perms;
     63 
     64 # logd access - work to be done is a PII safe log (possibly an event log?)
     65 # TODO read_logd(incidentd)
     66 # TODO control_logd(incidentd)
     67 
     68 # Allow incidentd to find these standard groups of services.
     69 # Others can be whitelisted individually.
     70 allow incidentd {
     71   system_server_service
     72   app_api_service
     73   system_api_service
     74 }:service_manager find;
     75 
     76 # Only incidentd can publish the binder service
     77 add_service(incidentd, incident_service)
     78 
     79 # Allow pipes from (and only from) incident
     80 allow incidentd incident:fd use;
     81 allow incidentd incident:fifo_file write;
     82 
     83 # Allow incident to call back to incident with status updates.
     84 binder_call(incidentd, incident)
     85 
     86 ###
     87 ### neverallow rules
     88 ###
     89 
     90 # only system_server, system_app and incident command can find the incident service
     91 neverallow { domain -system_server -system_app -incident -incidentd } incident_service:service_manager find;
     92 
     93 # only incidentd and the other root services in limited circumstances
     94 # can get to the files in /data/misc/incidents
     95 #
     96 # write, execute, append are forbidden almost everywhere
     97 neverallow { domain -incidentd -init -vold } incident_data_file:file {
     98   w_file_perms
     99   x_file_perms
    100   create
    101   rename
    102   setattr
    103   unlink
    104   append
    105 };
    106 # read is also allowed by system_server, for when the file is handed to dropbox
    107 neverallow { domain -incidentd -init -vold -system_server } incident_data_file:file r_file_perms;
    108 # limited access to the directory itself
    109 neverallow { domain -incidentd -init -vold } incident_data_file:dir create_dir_perms;
    110 
    111