PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow incidentd to parse persisted log

Browse Source 
Allow incidentd to run incident-helper-cmd, a Java program spawn by
app_process.
Allow incidentd to read /data/misc/logd and its files on userdebug
and eng build.

Bug: 147924172
Test: Build, flash and verify "adb shell incident -p EXPLICIT 1116"
      can parse persisted logs.

Change-Id: Id0aa4286c304a336741ce8c0949b12ec559c2e16
This commit is contained in:
Mike Ma 2020-01-17 19:00:16 -08:00
parent 7eca7d1e9b
commit 08f494d200
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
private/incidentd.te
View File

@ -128,10 +128,18 @@ unix_socket_connect(incidentd, tombstoned_intercept, tombstoned)
# Run a shell.
allow incidentd shell_exec:file rx_file_perms;
# For running am, incident-helper-cmd and similar framework commands.
# Run /system/bin/app_process.
allow incidentd zygote_exec:file { rx_file_perms };
# logd access - work to be done is a PII safe log (possibly an event log?)
userdebug_or_eng(`read_logd(incidentd)')
# TODO control_logd(incidentd)
# Access /data/misc/logd
allow incidentd misc_logd_file:dir r_dir_perms;
allow incidentd misc_logd_file:file r_file_perms;
# Allow incidentd to find these standard groups of services.
# Others can be whitelisted individually.
allow incidentd {

2
private/logpersist.te
View File

@ -24,6 +24,6 @@ neverallow logpersist {
userdebug_or_eng(`-misc_logd_file -coredump_file')
with_native_coverage(`-method_trace_data_file')
}:file { create write append };
neverallow { domain -init -dumpstate userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_rw_file_perms;
neverallow { domain -init -dumpstate -incidentd userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_rw_file_perms;
neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_w_file_perms;
neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };