PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
130fee6e95
android_system_sepolicy/private/traceur_app.te

16 lines
485 B
Plaintext
Raw Normal View History

Adding a traceur_app domain to remove it from shell This CL creates a traceur_app domain with userdebug privileges akin to what shell has with regards to being able to find most services on device. Previously, traceur was running as shell which was an unintentional abuse of selinux architecture. Bug: 68126425 Test: Traceur functions outside of shell user privilege Change-Id: Ib5090e7e8225ad201b3ec24b506fe2717101d0f1
2017-12-11 16:19:23 -08:00
typeattribute traceur_app coredomain;
Enable Traceur on user builds. Test: Standard Traceur workflow works successfully with no selinux denials on a user build. Bug: 64762598 Change-Id: I0dfe506d463b63d70c5bda03f8706041ea7ab448
2018-01-09 12:24:47 -08:00
app_domain(traceur_app);
allow traceur_app debugfs_tracing:file rw_file_perms;
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-30 18:14:45 -08:00
allow traceur_app debugfs_tracing_debug:dir r_dir_perms;
Enable Traceur on user builds. Test: Standard Traceur workflow works successfully with no selinux denials on a user build. Bug: 64762598 Change-Id: I0dfe506d463b63d70c5bda03f8706041ea7ab448
2018-01-09 12:24:47 -08:00
Adding a traceur_app domain to remove it from shell This CL creates a traceur_app domain with userdebug privileges akin to what shell has with regards to being able to find most services on device. Previously, traceur was running as shell which was an unintentional abuse of selinux architecture. Bug: 68126425 Test: Traceur functions outside of shell user privilege Change-Id: Ib5090e7e8225ad201b3ec24b506fe2717101d0f1
2017-12-11 16:19:23 -08:00
userdebug_or_eng(`
Adding write permissions to traceur Fixing denials that stopped traceur from being able to write to debugfs_tracing. Also cleaning up general find denials for services that traceur doesn't have permission to access. Additionally, labeling /data/local/trace as a trace_data_file in order to give traceur a UX friendly area to write its traces to now that it will no longer be a shell user. It will be write/readable by traceur, and deletable/readable by shell. Test: Traceur functionality is not being blocked by selinux policy Bug: 68126425 Change-Id: I201c82975a31094102e90bc81454d3c2a48fae36
2018-01-15 16:44:04 -08:00
allow traceur_app debugfs_tracing_debug:file rw_file_perms;
Adding a traceur_app domain to remove it from shell This CL creates a traceur_app domain with userdebug privileges akin to what shell has with regards to being able to find most services on device. Previously, traceur was running as shell which was an unintentional abuse of selinux architecture. Bug: 68126425 Test: Traceur functions outside of shell user privilege Change-Id: Ib5090e7e8225ad201b3ec24b506fe2717101d0f1
2017-12-11 16:19:23 -08:00
')
Enable Traceur on user builds. Test: Standard Traceur workflow works successfully with no selinux denials on a user build. Bug: 64762598 Change-Id: I0dfe506d463b63d70c5bda03f8706041ea7ab448
2018-01-09 12:24:47 -08:00
allow traceur_app trace_data_file:file create_file_perms;
Allow Traceur app to remove trace files. Bug: 73660835 Test: With the other commit on this topic, clearing all trace files via the app works properly. Change-Id: I27a4a5a14d9afe817683f1b046a644648a84badc
2018-02-20 14:47:08 -08:00
allow traceur_app trace_data_file:dir rw_dir_perms;
Enable Traceur on user builds. Test: Standard Traceur workflow works successfully with no selinux denials on a user build. Bug: 64762598 Change-Id: I0dfe506d463b63d70c5bda03f8706041ea7ab448
2018-01-09 12:24:47 -08:00
allow traceur_app atrace_exec:file rx_file_perms;
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-30 18:14:45 -08:00
dontaudit traceur_app debugfs_tracing_debug:file audit_access;
Reference in New Issue Copy Permalink