149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# dumpstate 249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaletype dumpstate, domain, mlstrustedsubject; 349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaletype dumpstate_exec, exec_type, file_type; 449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalenet_domain(dumpstate) 649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalebinder_use(dumpstate) 749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalewakelock_use(dumpstate) 849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow setting process priority, protect from OOM killer, and dropping 1049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# privileges by switching UID / GID 1149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate self:global_capability_class_set { setuid setgid sys_resource }; 1249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 1349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow dumpstate to scan through /proc/pid for all processes 1449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaler_dir_file(dumpstate, domain) 1549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 1649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate self:global_capability_class_set { 1749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale # Send signals to processes 1849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale kill 1949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale # Run iptables 2049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale net_raw 2149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale net_admin 2249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale}; 2349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 2449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow executing files on system, such as: 2549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# /system/bin/toolbox 2649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# /system/bin/logcat 2749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# /system/bin/dumpsys 2849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate system_file:file execute_no_trans; 2949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalenot_full_treble(`allow dumpstate vendor_file:file execute_no_trans;') 3049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate toolbox_exec:file rx_file_perms; 3149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 3249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# hidl searches for files in /system/lib(64)/hw/ 3349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate system_file:dir r_dir_perms; 3449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 3549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Create and write into /data/anr/ 3649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate self:global_capability_class_set { dac_override chown fowner fsetid }; 3749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate anr_data_file:dir rw_dir_perms; 3849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate anr_data_file:file create_file_perms; 3949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 4049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow reading /data/system/uiderrors.txt 4149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# TODO: scope this down. 4249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate system_data_file:file r_file_perms; 4349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 4449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Read dmesg 4549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate self:global_capability2_class_set syslog; 4649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate kernel:system syslog_read; 4749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 4849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Read /sys/fs/pstore/console-ramoops 4949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate pstorefs:dir r_dir_perms; 5049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate pstorefs:file r_file_perms; 5149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 5249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Get process attributes 5349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate domain:process getattr; 5449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 5549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Signal java processes to dump their stack 5649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate { appdomain system_server }:process signal; 5749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 5849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Signal native processes to dump their stack. 5949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate { 6049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale # This list comes from native_processes_to_dump in dumputils/dump_utils.c 6149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale audioserver 6249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale cameraserver 6349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale drmserver 6449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale inputflinger 6549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale mediadrmserver 6649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale mediaextractor 6749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale mediametrics 6849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale mediaserver 6949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale sdcardd 7049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale surfaceflinger 7149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 7249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale # This list comes from hal_interfaces_to_dump in dumputils/dump_utils.c 7349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale hal_audio_server 7449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale hal_bluetooth_server 7549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale hal_camera_server 7649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale hal_drm_server 7749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale hal_graphics_composer_server 7849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale hal_sensors_server 7949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale hal_vr_server 8049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale mediacodec # TODO(b/36375899): hal_omx_server 8149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale}:process signal; 8249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 8349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Connect to tombstoned to intercept dumps. 8449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleunix_socket_connect(dumpstate, tombstoned_intercept, tombstoned) 8549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 8649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Access to /sys 8749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate sysfs_type:dir r_dir_perms; 8849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 8949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate { 9049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale sysfs_dm 9149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale sysfs_usb 9249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale sysfs_zram 9349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale}:file r_file_perms; 9449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 9549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Other random bits of data we want to collect 9649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate qtaguid_proc:file r_file_perms; 9749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate debugfs:file r_file_perms; 9849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 9949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# df for 10049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate { 10149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale block_device 10249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale cache_file 10318096f9c6463192c93d5fc3e56da7441747665fbJaegeuk Kim metadata_file 10449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale rootfs 10549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale selinuxfs 10649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale storage_file 10749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale tmpfs 10849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale}:dir { search getattr }; 10949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate fuse_device:chr_file getattr; 11049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate { dm_device cache_block_device }:blk_file getattr; 11149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate { cache_file rootfs }:lnk_file { getattr read }; 11249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 11349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Read /dev/cpuctl and /dev/cpuset 11449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaler_dir_file(dumpstate, cgroup) 11549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 11649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow dumpstate to make binder calls to any binder service 11749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalebinder_call(dumpstate, binderservicedomain) 11849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalebinder_call(dumpstate, { appdomain netd wificond }) 11949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 12049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalehal_client_domain(dumpstate, hal_dumpstate) 12149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalehal_client_domain(dumpstate, hal_graphics_allocator) 12249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Vibrate the device after we are done collecting the bugreport 12349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalehal_client_domain(dumpstate, hal_vibrator) 12449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 12549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Reading /proc/PID/maps of other processes 12649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate self:global_capability_class_set sys_ptrace; 12749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 12849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow the bugreport service to create a file in 12949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# /data/data/com.android.shell/files/bugreports/bugreport 13049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate shell_data_file:dir create_dir_perms; 13149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate shell_data_file:file create_file_perms; 13249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 13349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Run a shell. 13449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate shell_exec:file rx_file_perms; 13549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 13649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# For running am and similar framework commands. 13749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Run /system/bin/app_process. 13849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate zygote_exec:file rx_file_perms; 13949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Dalvik Compiler JIT. 14049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate ashmem_device:chr_file execute; 14149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate self:process execmem; 14249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# For art. 14349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate dalvikcache_data_file:dir { search getattr }; 14449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate dalvikcache_data_file:file { r_file_perms execute }; 14549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate dalvikcache_data_file:lnk_file r_file_perms; 14649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 14749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# For Bluetooth 14849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate bluetooth_data_file:dir search; 14949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate bluetooth_logs_data_file:dir r_dir_perms; 15049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate bluetooth_logs_data_file:file r_file_perms; 15149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 15249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Dumpstate calls screencap, which grabs a screenshot. Needs gpu access 15349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate gpu_device:chr_file rw_file_perms; 15449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 15549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# logd access 15649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleread_logd(dumpstate) 15749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalecontrol_logd(dumpstate) 15849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleread_runtime_log_tags(dumpstate) 15949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 16049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Read files in /proc 16149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate { 16249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale proc_buddyinfo 16349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale proc_cmdline 16449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale proc_meminfo 16549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale proc_modules 16649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale proc_net 16749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale proc_pipe_conf 16849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale proc_pagetypeinfo 16949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale proc_qtaguid_stat 17049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale proc_version 17149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale proc_vmallocinfo 17249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale proc_vmstat 17349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale}:file r_file_perms; 17449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 17549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Read network state info files. 17649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate net_data_file:dir search; 17749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate net_data_file:file r_file_perms; 17849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 17949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# List sockets via ss. 18049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read }; 18149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 18249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Access /data/tombstones. 18349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate tombstone_data_file:dir r_dir_perms; 18449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate tombstone_data_file:file r_file_perms; 18549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 18649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Access /cache/recovery 18749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate cache_recovery_file:dir r_dir_perms; 18849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate cache_recovery_file:file r_file_perms; 18949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 19049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Access /data/misc/recovery 19149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate recovery_data_file:dir r_dir_perms; 19249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate recovery_data_file:file r_file_perms; 19349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 194763dcc317556b9c9d3137641d2ed86232bb189f9Ian Pedowitz#Access /data/misc/update_engine_log 195763dcc317556b9c9d3137641d2ed86232bb189f9Ian Pedowitzallow dumpstate update_engine_log_data_file:dir r_dir_perms; 196763dcc317556b9c9d3137641d2ed86232bb189f9Ian Pedowitzallow dumpstate update_engine_log_data_file:file r_file_perms; 197763dcc317556b9c9d3137641d2ed86232bb189f9Ian Pedowitz 19849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Access /data/misc/profiles/{cur,ref}/ 19949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleuserdebug_or_eng(` 20049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale allow dumpstate user_profile_data_file:dir r_dir_perms; 20149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale allow dumpstate user_profile_data_file:file r_file_perms; 20249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale') 20349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 20449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Access /data/misc/logd 20549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleuserdebug_or_eng(` 20649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale allow dumpstate misc_logd_file:dir r_dir_perms; 20749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale allow dumpstate misc_logd_file:file r_file_perms; 20849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale') 20949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 21049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate { 21149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale service_manager_type 21249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale -dumpstate_service 21349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale -gatekeeper_service 21449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale -incident_service 21549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale -virtual_touchpad_service 21649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale -vold_service 21749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale -vr_hwc_service 21849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale}:service_manager find; 21949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# suppress denials for services dumpstate should not be accessing. 22049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaledontaudit dumpstate { 22149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale dumpstate_service 22249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale gatekeeper_service 22349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale incident_service 22449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale virtual_touchpad_service 22549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale vold_service 22649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale vr_hwc_service 22749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale}:service_manager find; 22849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 22949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate servicemanager:service_manager list; 23049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate hwservicemanager:hwservice_manager list; 23149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 23249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate devpts:chr_file rw_file_perms; 23349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 23449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Set properties. 23549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# dumpstate_prop is used to share state with the Shell app. 23649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleset_prop(dumpstate, dumpstate_prop) 23749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleset_prop(dumpstate, exported_dumpstate_prop) 23849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# dumpstate_options_prop is used to pass extra command-line args. 23949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleset_prop(dumpstate, dumpstate_options_prop) 24049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 241763dcc317556b9c9d3137641d2ed86232bb189f9Ian Pedowitz# Read any system properties 242763dcc317556b9c9d3137641d2ed86232bb189f9Ian Pedowitzget_prop(dumpstate, property_type) 24349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 24449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Access to /data/media. 24549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# This should be removed if sdcardfs is modified to alter the secontext for its 24649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# accesses to the underlying FS. 24749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate media_rw_data_file:dir getattr; 24849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate proc_interrupts:file r_file_perms; 24949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate proc_zoneinfo:file r_file_perms; 25049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 25149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Create a service for talking back to system_server 25249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleadd_service(dumpstate, dumpstate_service) 25349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 25449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# use /dev/ion for screen capture 25549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate ion_device:chr_file r_file_perms; 25649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 25749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow dumpstate to run top 25849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate proc_stat:file r_file_perms; 25949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 26049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow dumpstate to talk to installd over binder 26149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwalebinder_call(dumpstate, installd); 26249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 26349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow dumpstate to run ip xfrm policy 26449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_read }; 26549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 26649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Allow dumpstate to run iotop 26749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate self:netlink_socket create_socket_perms_no_ioctl; 26849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# newer kernels (e.g. 4.4) have a new class for sockets 26949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleallow dumpstate self:netlink_generic_socket create_socket_perms_no_ioctl; 27049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 271763dcc317556b9c9d3137641d2ed86232bb189f9Ian Pedowitz# Allow dumpstate to kill vendor dumpstate service by init 272763dcc317556b9c9d3137641d2ed86232bb189f9Ian Pedowitzset_prop(dumpstate, ctl_dumpstate_prop) 273763dcc317556b9c9d3137641d2ed86232bb189f9Ian Pedowitz 27449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### 27549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### neverallow rules 27649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### 27749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 27849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# dumpstate has capability sys_ptrace, but should only use that capability for 27949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# accessing sensitive /proc/PID files, never for using ptrace attach. 28049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow dumpstate *:process ptrace; 28149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 28249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# only system_server, dumpstate, traceur_app and shell can find the dumpstate service 28349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow { 28449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale domain 28549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale -system_server 28649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale -shell 28749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale -traceur_app 28849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale -dumpstate 28949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale} dumpstate_service:service_manager find; 290