cf71a5ae60
The sheer volume of these can cause confusion.
Sample denials (repeated for many processes):
denied { getattr } for path="/proc/1/status" dev="proc" ino=24427 scontext=u:r:performanced:s0 tcontext=u:r:init:s0 tclass=file permissive=1
denied { open } for path="/proc/1" dev="proc" ino=18608 scontext=u:r:performanced:s0 tcontext=u:r:init:s0 tclass=dir permissive=1
denied { open } for path="/proc/1/status" dev="proc" ino=24427 scontext=u:r:performanced:s0 tcontext=u:r:init:s0 tclass=file permissive=1
denied { read } for name="status" dev="proc" ino=24427 scontext=u:r:performanced:s0 tcontext=u:r:init:s0 tclass=file permissive=1
Bug: 72643420
Test: Denials no longer present in permissive mode.
Change-Id: Ic07b9b0b59ca2122c4843095b63075ab8fd2c70b
31 lines
1.1 KiB
Plaintext
31 lines
1.1 KiB
Plaintext
# performanced
|
|
type performanced, domain, mlstrustedsubject;
|
|
type performanced_exec, exec_type, file_type;
|
|
|
|
# Needed to check for app permissions.
|
|
binder_use(performanced)
|
|
binder_call(performanced, system_server)
|
|
allow performanced permission_service:service_manager find;
|
|
|
|
pdx_server(performanced, performance_client)
|
|
|
|
# TODO: use file caps to obtain sys_nice instead of setuid / setgid.
|
|
allow performanced self:global_capability_class_set { setuid setgid sys_nice };
|
|
|
|
# Access /proc to validate we're only affecting threads in the same thread group.
|
|
# Performanced also shields unbound kernel threads. It scans every task in the
|
|
# root cpu set, but only affects the kernel threads.
|
|
r_dir_file(performanced, { appdomain bufferhubd kernel surfaceflinger })
|
|
dontaudit performanced domain:dir read;
|
|
allow performanced { appdomain bufferhubd kernel surfaceflinger }:process setsched;
|
|
|
|
# These /proc accesses only show up in permissive mode but they
|
|
# generate a lot of noise in the log.
|
|
userdebug_or_eng(`
|
|
dontaudit performanced domain:dir open;
|
|
dontaudit performanced domain:file { open read getattr };
|
|
')
|
|
|
|
# Access /dev/cpuset/cpuset.cpus
|
|
r_dir_file(performanced, cgroup)
|