2012-01-04 09:33:27 -08:00
|
|
|
# debugger interface
|
2015-11-03 09:54:39 -08:00
|
|
|
type debuggerd, domain, domain_deprecated;
|
2012-01-04 09:33:27 -08:00
|
|
|
type debuggerd_exec, exec_type, file_type;
|
|
|
|
|
2013-10-29 11:42:35 -07:00
|
|
|
typeattribute debuggerd mlstrustedsubject;
|
2015-11-17 16:21:38 -08:00
|
|
|
allow debuggerd self:capability { dac_override sys_ptrace chown kill fowner setuid setgid };
|
2013-10-29 11:42:35 -07:00
|
|
|
allow debuggerd self:capability2 { syslog };
|
|
|
|
allow debuggerd domain:dir r_dir_perms;
|
|
|
|
allow debuggerd domain:file r_file_perms;
|
2014-05-16 19:14:13 -07:00
|
|
|
allow debuggerd domain:lnk_file read;
|
2016-04-27 12:32:36 -07:00
|
|
|
allow debuggerd {
|
|
|
|
domain
|
|
|
|
-adbd
|
|
|
|
-debuggerd
|
|
|
|
-healthd
|
|
|
|
-init
|
|
|
|
-keystore
|
|
|
|
-ueventd
|
|
|
|
-watchdogd
|
2016-09-14 02:00:13 -07:00
|
|
|
}:process { execmem ptrace getattr };
|
2015-11-17 16:21:38 -08:00
|
|
|
allow debuggerd tombstone_data_file:dir rw_dir_perms;
|
2013-10-29 11:42:35 -07:00
|
|
|
allow debuggerd tombstone_data_file:file create_file_perms;
|
2014-08-18 17:09:38 -07:00
|
|
|
allow debuggerd shared_relro_file:dir r_dir_perms;
|
|
|
|
allow debuggerd shared_relro_file:file r_file_perms;
|
2016-03-08 18:02:15 -08:00
|
|
|
allow debuggerd domain:process { sigstop sigkill signal };
|
2013-10-29 11:42:35 -07:00
|
|
|
allow debuggerd exec_type:file r_file_perms;
|
|
|
|
# Access app library
|
|
|
|
allow debuggerd system_data_file:file open;
|
2015-01-18 17:39:53 -08:00
|
|
|
# Allow debuggerd to redirect a dump_backtrace request to itself.
|
|
|
|
# This only happens on 64 bit systems, where all requests go to the 64 bit
|
|
|
|
# debuggerd and get redirected to the 32 bit debuggerd if the process is 32 bit.
|
2015-12-03 16:10:05 -08:00
|
|
|
|
2016-05-11 18:40:27 -07:00
|
|
|
allow debuggerd {
|
|
|
|
audioserver
|
2016-05-12 17:28:34 -07:00
|
|
|
bluetooth
|
2016-05-11 18:40:27 -07:00
|
|
|
cameraserver
|
|
|
|
drmserver
|
|
|
|
inputflinger
|
|
|
|
mediacodec
|
|
|
|
mediadrmserver
|
|
|
|
mediaextractor
|
|
|
|
mediaserver
|
|
|
|
sdcardd
|
|
|
|
surfaceflinger
|
|
|
|
}:debuggerd dump_backtrace;
|
2013-09-27 07:24:49 -07:00
|
|
|
|
|
|
|
# Connect to system_server via /data/system/ndebugsocket.
|
|
|
|
unix_socket_connect(debuggerd, system_ndebug, system_server)
|
2013-11-12 15:34:52 -08:00
|
|
|
|
2014-02-05 16:36:25 -08:00
|
|
|
userdebug_or_eng(`
|
|
|
|
allow debuggerd input_device:dir r_dir_perms;
|
|
|
|
allow debuggerd input_device:chr_file rw_file_perms;
|
|
|
|
')
|
|
|
|
|
2013-11-12 15:34:52 -08:00
|
|
|
# logd access
|
|
|
|
read_logd(debuggerd)
|
2014-07-24 12:25:43 -07:00
|
|
|
|
|
|
|
# Check SELinux permissions.
|
|
|
|
selinux_check_access(debuggerd)
|
2016-09-09 16:27:17 -07:00
|
|
|
|
|
|
|
# Read /data/dalvik-cache.
|
|
|
|
allow debuggerd dalvikcache_data_file:dir { search getattr };
|
|
|
|
allow debuggerd dalvikcache_data_file:file r_file_perms;
|