0e06c13784
Developers should be able to use systrace with user builds.
This requires read access to /sys/kernel/debug/tracing/trace,
otherwise the following error occurs:
$ atrace
capturing trace... done
TRACE:
error opening /sys/kernel/debug/tracing/trace: Permission denied (13)
with the following SELinux denial:
<4>[ 79.830542] type=1400 audit(11940551.039:8): avc: denied { read } for pid=1156 comm="atrace" name="trace" dev="debugfs" ino=3024 scontext=u:r:shell:s0 tcontext=u:object_r:debugfs:s0 tclass=file
At least on the kernel I've tested this on, debugfs doesn't support
setting SELinux file labels. Grant read access to all of debugfs to
work around this limitation.
Bug: 13904660
Change-Id: Ib58e98972c5012e9b34fec9e0a6094641638cd9a
35 lines
1.3 KiB
Plaintext
35 lines
1.3 KiB
Plaintext
# Rules for all shell domains (e.g. console service and adb shell).
|
|
|
|
# Access /data/local/tmp.
|
|
allow shelldomain shell_data_file:dir create_dir_perms;
|
|
allow shelldomain shell_data_file:file create_file_perms;
|
|
allow shelldomain shell_data_file:file rx_file_perms;
|
|
|
|
# adb bugreport
|
|
unix_socket_connect(shelldomain, dumpstate, dumpstate)
|
|
|
|
allow shelldomain rootfs:dir r_dir_perms;
|
|
allow shelldomain devpts:chr_file rw_file_perms;
|
|
allow shelldomain tty_device:chr_file rw_file_perms;
|
|
allow shelldomain console_device:chr_file rw_file_perms;
|
|
allow shelldomain input_device:chr_file rw_file_perms;
|
|
allow shelldomain system_file:file x_file_perms;
|
|
allow shelldomain shell_exec:file rx_file_perms;
|
|
allow shelldomain zygote_exec:file rx_file_perms;
|
|
|
|
r_dir_file(shelldomain, apk_data_file)
|
|
|
|
# Set properties.
|
|
unix_socket_connect(shelldomain, property, init)
|
|
allow shelldomain shell_prop:property_service set;
|
|
allow shelldomain ctl_dumpstate_prop:property_service set;
|
|
allow shelldomain debug_prop:property_service set;
|
|
allow shelldomain powerctl_prop:property_service set;
|
|
|
|
# systrace support - allow atrace to run
|
|
# debugfs doesn't support labeling individual files, so we have
|
|
# to grant read access to all of /sys/kernel/debug.
|
|
# Directory read access and file write access is already granted
|
|
# in domain.te.
|
|
allow shelldomain debugfs:file r_file_perms;
|