ee57f177d8
init should register native services with lmkd so that they can be killed when necessary. Allow init to communicate with lmkd over dedicated socket the same way AMS does. Allow lmkd to kill and manipulate native processes that were registered with lmkd. Bug: 129011369 Test: boot and verify native service registration Test: verify lmkd can kill registered native processes using lmkd_unit_test Change-Id: Idfc814bd08115c548e97f11a6bdb006790cbb4ed Signed-off-by: Suren Baghdasaryan <surenb@google.com>
71 lines
2.2 KiB
Plaintext
71 lines
2.2 KiB
Plaintext
# lmkd low memory killer daemon
|
|
type lmkd, domain, mlstrustedsubject;
|
|
type lmkd_exec, system_file_type, exec_type, file_type;
|
|
|
|
allow lmkd self:global_capability_class_set { dac_override dac_read_search sys_resource kill };
|
|
|
|
# lmkd locks itself in memory, to prevent it from being
|
|
# swapped out and unable to kill other memory hogs.
|
|
# system/core commit b28ff9131363f7b4a698990da5748b2a88c3ed35
|
|
# b/16236289
|
|
allow lmkd self:global_capability_class_set ipc_lock;
|
|
|
|
## Open and write to /proc/PID/oom_score_adj and /proc/PID/timerslack_ns
|
|
## TODO: maybe scope this down?
|
|
r_dir_file(lmkd, domain)
|
|
allow lmkd domain:file write;
|
|
|
|
## Writes to /sys/module/lowmemorykiller/parameters/minfree
|
|
r_dir_file(lmkd, sysfs_lowmemorykiller)
|
|
allow lmkd sysfs_lowmemorykiller:file w_file_perms;
|
|
|
|
# setsched and send kill signals to any registered process
|
|
allow lmkd domain:process { setsched sigkill };
|
|
# TODO: delete this line b/131761776
|
|
allow lmkd kernel:process { setsched };
|
|
|
|
# Clean up old cgroups
|
|
allow lmkd cgroup:dir { remove_name rmdir };
|
|
|
|
# Allow to read memcg stats
|
|
allow lmkd cgroup:file r_file_perms;
|
|
|
|
# Set self to SCHED_FIFO
|
|
allow lmkd self:global_capability_class_set sys_nice;
|
|
|
|
allow lmkd proc_zoneinfo:file r_file_perms;
|
|
allow lmkd proc_vmstat:file r_file_perms;
|
|
|
|
# Set sys.lmk.* properties.
|
|
set_prop(lmkd, system_lmk_prop)
|
|
|
|
# live lock watchdog process allowed to look through /proc/
|
|
allow lmkd domain:dir { search open read };
|
|
allow lmkd domain:file { open read };
|
|
|
|
# live lock watchdog process allowed to dump process trace and
|
|
# reboot because orderly shutdown may not be possible.
|
|
allow lmkd proc_sysrq:file rw_file_perms;
|
|
|
|
# Read /proc/lowmemorykiller
|
|
allow lmkd proc_lowmemorykiller:file r_file_perms;
|
|
|
|
# Read /proc/meminfo
|
|
allow lmkd proc_meminfo:file r_file_perms;
|
|
|
|
# Read /proc/pressure/cpu and /proc/pressure/io
|
|
allow lmkd proc_pressure_cpu:file r_file_perms;
|
|
allow lmkd proc_pressure_io:file r_file_perms;
|
|
|
|
# Read/Write /proc/pressure/memory
|
|
allow lmkd proc_pressure_mem:file rw_file_perms;
|
|
|
|
# Allow lmkd to write to statsd.
|
|
unix_socket_send(lmkd, statsdw, statsd)
|
|
|
|
### neverallow rules
|
|
|
|
# never honor LD_PRELOAD
|
|
neverallow * lmkd:process noatsecure;
|
|
neverallow lmkd self:global_capability_class_set sys_ptrace;
|