Allow dumpsys meminfo to print out DMA-BUF statistics
These permissions fix the following denials:
avc: denied { read } for name="buffers" dev="sysfs" ino=3267
scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_dmabuf_stats:s0
tclass=dir permissive=1
avc: denied { open } for path="/sys/kernel/dmabuf/buffers" dev="sysfs"
ino=3267 scontext=u:r:system_server:s0
tcontext=u:object_r:sysfs_dmabuf_stats:s0 tclass=dir permissive=1
avc: denied { read } for name="size" dev="sysfs"
ino=30556 scontext=u:r:system_server:s0
tcontext=u:object_r:sysfs_dmabuf_stats:s0 tclass=file permissive=1
avc: denied { open } for path="/sys/kernel/dmabuf/buffers/41673/size" dev="sysfs"
ino=30556 scontext=u:r:system_server:s0
tcontext=u:object_r:sysfs_dmabuf_stats:s0 tclass=file permissive=1
avc: denied { getattr } for path="/sys/kernel/dmabuf/buffers/41673/size" dev="sysfs"
ino=30556 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_dmabuf_stats:s0
tclass=file permissive=1
avc: denied { read } for name="dma_heap" dev="tmpfs" ino=344
scontext=u:r:system_server:s0 tcontext=u:object_r:dmabuf_heap_device:s0
tclass=dir permissive=1
avc: denied { open } for path="/dev/dma_heap" dev="tmpfs" ino=344
scontext=u:r:system_server:s0 tcontext=u:object_r:dmabuf_heap_device:s0
tclass=dir permissive=1
Test: adb shell dumpsys meminfo
Bug: 167709539
Change-Id: Ifa43fd16369d5da1db16e45ff0e189da0c975b75
diff --git a/private/system_server.te b/private/system_server.te
index 06673c3..906e259 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -192,6 +192,14 @@
# Read /sys/kernel/dma_heap/*.
allow system_server sysfs_dma_heap:file r_file_perms;
+# Allow reading DMA-BUF sysfs stats from /sys/kernel/dmabuf.
+allow system_server sysfs_dmabuf_stats:dir r_dir_perms;
+allow system_server sysfs_dmabuf_stats:file r_file_perms;
+
+# Allow ActivityManager to look at the list of DMA-BUF heaps from /dev/dma_heap
+# for dumpsys meminfo
+allow system_server dmabuf_heap_device:dir r_dir_perms;
+
# The DhcpClient and WifiWatchdog use packet_sockets
allow system_server self:packet_socket create_socket_perms_no_ioctl;