crash_dump: disallow ptrace of TCB components
Remove permissions and add neverallow assertion.
(cherry picked from commit f1554f1588eab05eca7eb7ccba41d5955a563837)
Bug: 110107376
Test: kill -6 <components excluded from ptrace>
Change-Id: I2dc872f5c02749fbaf8ca6bc7e3e38404151442c
diff --git a/private/crash_dump.te b/private/crash_dump.te
index fb73f08..186977f 100644
--- a/private/crash_dump.te
+++ b/private/crash_dump.te
@@ -1 +1,26 @@
typeattribute crash_dump coredomain;
+
+allow crash_dump {
+ domain
+ -bpfloader
+ -crash_dump
+ -init
+ -kernel
+ -keystore
+ -logd
+ -ueventd
+ -vendor_init
+ -vold
+}:process { ptrace signal sigchld sigstop sigkill };
+
+neverallow crash_dump {
+ bpfloader
+ init
+ kernel
+ keystore
+ logd
+ userdebug_or_eng(`-logd')
+ ueventd
+ vendor_init
+ vold
+}:process { ptrace signal sigstop sigkill };