149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# android debug logging, logpersist domains 249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaletype logpersist, domain; 349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### 549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### Neverallow rules 649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### 749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale### logpersist should NEVER do any of this 849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Block device access. 1049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow logpersist dev_type:blk_file { read write }; 1149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 1249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# ptrace any other app 1349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow logpersist domain:process ptrace; 1449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 1549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Write to files in /data/data or system files on /data except misc_logd_file 1649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow logpersist { app_data_file system_data_file }:dir_file_class_set write; 1749b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale 1849b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Only init should be allowed to enter the logpersist domain via exec() 1949b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# Following is a list of debug domains we know that transition to logpersist 2049b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# neverallow_with_undefined_domains { 2149b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# domain 2249b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# -init # goldfish, logcatd, raft 2349b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# -mmi # bat, mtp8996, msmcobalt 2449b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# -system_app # Smith.apk 2549b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwale# } logpersist:process transition; 2649b79029cbb4bfb362b6b823e63bb467e8012230Wale Ogunwaleneverallow * logpersist:process dyntransition; 27