b51c4dd39a
On 64 bit systems, all requests will first go to the 64 bit debuggerd which will redirect to the 32 bit debuggerd if necessary. This avoids any permissions problems where a java process needs to be able to read the elf data for executables. Instead the permissions are granted to debuggerd instead. Also remove the permissions to read the /system/bin executables from dumpstate since they aren't necessary any more. Bug: https://code.google.com/p/android/issues/detail?id=97024 Change-Id: I80ab1a177a110aa7381c2a4b516cfe71ef2a4808
43 lines
1.7 KiB
Plaintext
43 lines
1.7 KiB
Plaintext
# debugger interface
|
|
type debuggerd, domain;
|
|
type debuggerd_exec, exec_type, file_type;
|
|
|
|
init_daemon_domain(debuggerd)
|
|
typeattribute debuggerd mlstrustedsubject;
|
|
allow debuggerd self:capability { dac_override sys_ptrace chown kill fowner };
|
|
allow debuggerd self:capability2 { syslog };
|
|
allow debuggerd domain:dir r_dir_perms;
|
|
allow debuggerd domain:file r_file_perms;
|
|
allow debuggerd domain:lnk_file read;
|
|
allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process { ptrace getattr };
|
|
security_access_policy(debuggerd)
|
|
allow debuggerd system_data_file:dir create_dir_perms;
|
|
allow debuggerd system_data_file:dir relabelfrom;
|
|
allow debuggerd tombstone_data_file:dir relabelto;
|
|
allow debuggerd tombstone_data_file:dir create_dir_perms;
|
|
allow debuggerd tombstone_data_file:file create_file_perms;
|
|
allow debuggerd shared_relro_file:dir r_dir_perms;
|
|
allow debuggerd shared_relro_file:file r_file_perms;
|
|
allow debuggerd domain:process { sigstop signal };
|
|
allow debuggerd exec_type:file r_file_perms;
|
|
# Access app library
|
|
allow debuggerd system_data_file:file open;
|
|
# Allow debuggerd to redirect a dump_backtrace request to itself.
|
|
# This only happens on 64 bit systems, where all requests go to the 64 bit
|
|
# debuggerd and get redirected to the 32 bit debuggerd if the process is 32 bit.
|
|
allow debuggerd { drmserver mediaserver sdcardd surfaceflinger inputflinger }:debuggerd dump_backtrace;
|
|
|
|
# Connect to system_server via /data/system/ndebugsocket.
|
|
unix_socket_connect(debuggerd, system_ndebug, system_server)
|
|
|
|
userdebug_or_eng(`
|
|
allow debuggerd input_device:dir r_dir_perms;
|
|
allow debuggerd input_device:chr_file rw_file_perms;
|
|
')
|
|
|
|
# logd access
|
|
read_logd(debuggerd)
|
|
|
|
# Check SELinux permissions.
|
|
selinux_check_access(debuggerd)
|