Home | History | Annotate | Download | only in public 
      1 # dumpstate
      2 type dumpstate, domain, mlstrustedsubject;
      3 type dumpstate_exec, exec_type, file_type;
      4 
      5 net_domain(dumpstate)
      6 binder_use(dumpstate)
      7 wakelock_use(dumpstate)
      8 
      9 # Allow setting process priority, protect from OOM killer, and dropping
     10 # privileges by switching UID / GID
     11 allow dumpstate self:capability { setuid setgid sys_resource };
     12 
     13 # Allow dumpstate to scan through /proc/pid for all processes
     14 r_dir_file(dumpstate, domain)
     15 
     16 allow dumpstate self:capability {
     17     # Send signals to processes
     18     kill
     19     # Run iptables
     20     net_raw
     21     net_admin
     22 };
     23 
     24 # Allow executing files on system, such as:
     25 #   /system/bin/toolbox
     26 #   /system/bin/logcat
     27 #   /system/bin/dumpsys
     28 allow dumpstate system_file:file execute_no_trans;
     29 not_full_treble(`allow dumpstate vendor_file:file execute_no_trans;')
     30 allow dumpstate toolbox_exec:file rx_file_perms;
     31 
     32 # hidl searches for files in /system/lib(64)/hw/
     33 allow dumpstate system_file:dir r_dir_perms;
     34 
     35 # Create and write into /data/anr/
     36 allow dumpstate self:capability { dac_override chown fowner fsetid };
     37 allow dumpstate anr_data_file:dir rw_dir_perms;
     38 allow dumpstate anr_data_file:file create_file_perms;
     39 
     40 # Allow reading /data/system/uiderrors.txt
     41 # TODO: scope this down.
     42 allow dumpstate system_data_file:file r_file_perms;
     43 
     44 # Read dmesg
     45 allow dumpstate self:capability2 syslog;
     46 allow dumpstate kernel:system syslog_read;
     47 
     48 # Read /sys/fs/pstore/console-ramoops
     49 allow dumpstate pstorefs:dir r_dir_perms;
     50 allow dumpstate pstorefs:file r_file_perms;
     51 
     52 # Get process attributes
     53 allow dumpstate domain:process getattr;
     54 
     55 # Signal java processes to dump their stack
     56 allow dumpstate { appdomain system_server }:process signal;
     57 
     58 # Signal native processes to dump their stack.
     59 allow dumpstate {
     60   # This list comes from native_processes_to_dump in dumpstate/utils.c
     61   audioserver
     62   cameraserver
     63   drmserver
     64   inputflinger
     65   mediadrmserver
     66   mediaextractor
     67   mediaserver
     68   sdcardd
     69   surfaceflinger
     70 
     71   # This list comes from hal_interfaces_to_dump in dumpstate/utils.c
     72   hal_audio_server
     73   hal_bluetooth_server
     74   hal_camera_server
     75   hal_graphics_composer_server
     76   hal_sensors_server
     77   hal_vr_server
     78   mediacodec # TODO(b/36375899): hal_omx_server
     79 }:process signal;
     80 
     81 # Connect to tombstoned to intercept dumps.
     82 unix_socket_connect(dumpstate, tombstoned_intercept, tombstoned)
     83 
     84 # TODO: added to match above sysfs rule. Remove me?
     85 allow dumpstate sysfs_usb:file w_file_perms;
     86 
     87 # Other random bits of data we want to collect
     88 allow dumpstate qtaguid_proc:file r_file_perms;
     89 allow dumpstate debugfs:file r_file_perms;
     90 
     91 # df for
     92 allow dumpstate {
     93   block_device
     94   cache_file
     95   rootfs
     96   selinuxfs
     97   storage_file
     98   tmpfs
     99 }:dir { search getattr };
    100 allow dumpstate fuse_device:chr_file getattr;
    101 allow dumpstate { dm_device cache_block_device }:blk_file getattr;
    102 allow dumpstate { cache_file rootfs }:lnk_file { getattr read };
    103 
    104 # Read /dev/cpuctl and /dev/cpuset
    105 r_dir_file(dumpstate, cgroup)
    106 
    107 # Allow dumpstate to make binder calls to any binder service
    108 binder_call(dumpstate, binderservicedomain)
    109 binder_call(dumpstate, { appdomain netd wificond })
    110 
    111 hal_client_domain(dumpstate, hal_dumpstate)
    112 hal_client_domain(dumpstate, hal_graphics_allocator)
    113 # Vibrate the device after we are done collecting the bugreport
    114 hal_client_domain(dumpstate, hal_vibrator)
    115 # For passthrough mode:
    116 allow dumpstate sysfs_vibrator:file { rw_file_perms getattr };
    117 
    118 # Reading /proc/PID/maps of other processes
    119 allow dumpstate self:capability sys_ptrace;
    120 
    121 # Allow the bugreport service to create a file in
    122 # /data/data/com.android.shell/files/bugreports/bugreport
    123 allow dumpstate shell_data_file:dir create_dir_perms;
    124 allow dumpstate shell_data_file:file create_file_perms;
    125 
    126 # Run a shell.
    127 allow dumpstate shell_exec:file rx_file_perms;
    128 
    129 # For running am and similar framework commands.
    130 # Run /system/bin/app_process.
    131 allow dumpstate zygote_exec:file rx_file_perms;
    132 # Dalvik Compiler JIT.
    133 allow dumpstate ashmem_device:chr_file execute;
    134 allow dumpstate self:process execmem;
    135 # For art.
    136 allow dumpstate dalvikcache_data_file:dir { search getattr };
    137 allow dumpstate dalvikcache_data_file:file { r_file_perms execute };
    138 allow dumpstate dalvikcache_data_file:lnk_file r_file_perms;
    139 
    140 # For Bluetooth
    141 allow dumpstate bluetooth_data_file:dir search;
    142 allow dumpstate bluetooth_logs_data_file:dir r_dir_perms;
    143 allow dumpstate bluetooth_logs_data_file:file r_file_perms;
    144 
    145 # Dumpstate calls screencap, which grabs a screenshot. Needs gpu access
    146 allow dumpstate gpu_device:chr_file rw_file_perms;
    147 
    148 # logd access
    149 read_logd(dumpstate)
    150 control_logd(dumpstate)
    151 read_runtime_log_tags(dumpstate)
    152 
    153 # Read files in /proc
    154 allow dumpstate proc_meminfo:file r_file_perms;
    155 allow dumpstate proc_net:file r_file_perms;
    156 r_dir_file(dumpstate, proc)
    157 
    158 # Read network state info files.
    159 allow dumpstate net_data_file:dir search;
    160 allow dumpstate net_data_file:file r_file_perms;
    161 
    162 # List sockets via ss.
    163 allow dumpstate self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read };
    164 
    165 # Access /data/tombstones.
    166 allow dumpstate tombstone_data_file:dir r_dir_perms;
    167 allow dumpstate tombstone_data_file:file r_file_perms;
    168 
    169 # Access /cache/recovery
    170 allow dumpstate cache_recovery_file:dir r_dir_perms;
    171 allow dumpstate cache_recovery_file:file r_file_perms;
    172 
    173 # Access /data/misc/recovery
    174 allow dumpstate recovery_data_file:dir r_dir_perms;
    175 allow dumpstate recovery_data_file:file r_file_perms;
    176 
    177 # Access /data/misc/profiles/{cur,ref}/
    178 userdebug_or_eng(`
    179   allow dumpstate user_profile_data_file:dir r_dir_perms;
    180   allow dumpstate user_profile_data_file:file r_file_perms;
    181 ')
    182 
    183 # Access /data/misc/logd
    184 userdebug_or_eng(`
    185   allow dumpstate misc_logd_file:dir r_dir_perms;
    186   allow dumpstate misc_logd_file:file r_file_perms;
    187 ')
    188 
    189 allow dumpstate { service_manager_type -gatekeeper_service -dumpstate_service -incident_service -virtual_touchpad_service -vr_hwc_service }:service_manager find;
    190 allow dumpstate servicemanager:service_manager list;
    191 allow dumpstate hwservicemanager:hwservice_manager list;
    192 
    193 allow dumpstate devpts:chr_file rw_file_perms;
    194 
    195 # Set properties.
    196 # dumpstate_prop is used to share state with the Shell app.
    197 set_prop(dumpstate, dumpstate_prop)
    198 # dumpstate_options_prop is used to pass extra command-line args.
    199 set_prop(dumpstate, dumpstate_options_prop)
    200 
    201 # Read device's serial number from system properties
    202 get_prop(dumpstate, serialno_prop)
    203 
    204 # Read state of logging-related properties
    205 get_prop(dumpstate, device_logging_prop)
    206 
    207 # Access to /data/media.
    208 # This should be removed if sdcardfs is modified to alter the secontext for its
    209 # accesses to the underlying FS.
    210 allow dumpstate media_rw_data_file:dir getattr;
    211 allow dumpstate proc_interrupts:file r_file_perms;
    212 allow dumpstate proc_zoneinfo:file r_file_perms;
    213 
    214 # Create a service for talking back to system_server
    215 add_service(dumpstate, dumpstate_service)
    216 
    217 # use /dev/ion for screen capture
    218 allow dumpstate ion_device:chr_file r_file_perms;
    219 
    220 # read default labeled files in /sys
    221 r_dir_file(dumpstate, sysfs)
    222 
    223 # Allow dumpstate to run top
    224 allow dumpstate proc_stat:file r_file_perms;
    225 
    226 # Allow dumpstate to read backlight details
    227 allow dumpstate sysfs_leds:lnk_file r_file_perms;
    228 allow dumpstate sysfs_leds:file r_file_perms;
    229 allow dumpstate sysfs_leds:dir search;
    230 
    231 # Allow dumpstate to talk to installd over binder
    232 binder_call(dumpstate, installd);
    233 
    234 # Allow dumpstate to run ip xfrm policy
    235 allow dumpstate self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_read };
    236 
    237 ###
    238 ### neverallow rules
    239 ###
    240 
    241 # dumpstate has capability sys_ptrace, but should only use that capability for
    242 # accessing sensitive /proc/PID files, never for using ptrace attach.
    243 neverallow dumpstate *:process ptrace;
    244 
    245 # only system_server, dumpstate and shell can find the dumpstate service
    246 neverallow { domain -system_server -shell -dumpstate } dumpstate_service:service_manager find;
    247 
    248 # Dumpstate should not be writing to any generically labeled sysfs files.
    249 # Create a specific label for the file type
    250 neverallow dumpstate sysfs:file no_w_file_perms;
    251