Allow incidentd to parse persisted log
Allow incidentd to run incident-helper-cmd, a Java program spawn by
app_process.
Allow incidentd to read /data/misc/logd and its files on userdebug
and eng build.
Bug: 147924172
Test: Build, flash and verify "adb shell incident -p EXPLICIT 1116"
can parse persisted logs.
Change-Id: Id0aa4286c304a336741ce8c0949b12ec559c2e16
diff --git a/private/incidentd.te b/private/incidentd.te
index b806f6e..45499fc 100644
--- a/private/incidentd.te
+++ b/private/incidentd.te
@@ -128,10 +128,18 @@
# Run a shell.
allow incidentd shell_exec:file rx_file_perms;
+# For running am, incident-helper-cmd and similar framework commands.
+# Run /system/bin/app_process.
+allow incidentd zygote_exec:file { rx_file_perms };
+
# logd access - work to be done is a PII safe log (possibly an event log?)
userdebug_or_eng(`read_logd(incidentd)')
# TODO control_logd(incidentd)
+# Access /data/misc/logd
+allow incidentd misc_logd_file:dir r_dir_perms;
+allow incidentd misc_logd_file:file r_file_perms;
+
# Allow incidentd to find these standard groups of services.
# Others can be whitelisted individually.
allow incidentd {