Home | History | Annotate | Download | only in public 
      1 # android user-space log manager
      2 type logd, domain, mlstrustedsubject;
      3 type logd_exec, exec_type, file_type;
      4 
      5 # Read access to pseudo filesystems.
      6 r_dir_file(logd, cgroup)
      7 r_dir_file(logd, proc)
      8 r_dir_file(logd, proc_meminfo)
      9 r_dir_file(logd, proc_net)
     10 
     11 allow logd self:capability { setuid setgid setpcap sys_nice audit_control };
     12 allow logd self:capability2 syslog;
     13 allow logd self:netlink_audit_socket { create_socket_perms_no_ioctl nlmsg_write };
     14 allow logd kernel:system syslog_read;
     15 allow logd kmsg_device:chr_file w_file_perms;
     16 allow logd system_data_file:{ file lnk_file } r_file_perms;
     17 allow logd pstorefs:dir search;
     18 allow logd pstorefs:file r_file_perms;
     19 userdebug_or_eng(`
     20   # Access to /data/misc/logd/event-log-tags
     21   allow logd misc_logd_file:dir r_dir_perms;
     22   allow logd misc_logd_file:file rw_file_perms;
     23 ')
     24 allow logd runtime_event_log_tags_file:file rw_file_perms;
     25 
     26 # Access device logging gating property
     27 get_prop(logd, device_logging_prop)
     28 
     29 r_dir_file(logd, domain)
     30 
     31 allow logd kernel:system syslog_mod;
     32 
     33 control_logd(logd)
     34 read_runtime_log_tags(logd)
     35 
     36 allow runtime_event_log_tags_file tmpfs:filesystem associate;
     37 # Typically harmlessly blindly trying to access via liblog
     38 # event tag mapping while in the untrusted_app domain.
     39 # Access for that domain is controlled and gated via the
     40 # event log tag service (albeit at a performance penalty,
     41 # expected to be locally cached).
     42 dontaudit domain runtime_event_log_tags_file:file { open read };
     43 
     44 ###
     45 ### Neverallow rules
     46 ###
     47 ### logd should NEVER do any of this
     48 
     49 # Block device access.
     50 neverallow logd dev_type:blk_file { read write };
     51 
     52 # ptrace any other app
     53 neverallow logd domain:process ptrace;
     54 
     55 # ... and nobody may ptrace me (except on userdebug or eng builds)
     56 neverallow { domain userdebug_or_eng(`-crash_dump') } logd:process ptrace;
     57 
     58 # Write to /system.
     59 neverallow logd system_file:dir_file_class_set write;
     60 
     61 # Write to files in /data/data or system files on /data
     62 neverallow logd { app_data_file system_data_file }:dir_file_class_set write;
     63 
     64 # Only init is allowed to enter the logd domain via exec()
     65 neverallow { domain -init } logd:process transition;
     66 neverallow * logd:process dyntransition;
     67 
     68 # protect the event-log-tags file
     69 neverallow {
     70   domain
     71   -init
     72   -logd
     73 } runtime_event_log_tags_file:file no_w_file_perms;
     74