commit 0e06c13784e50183401ca95fed2be49b0ead26fd
author Nick Kralevich <nnk@google.com> Wed Apr 30 11:35:02 2014 -0700
committer Nick Kralevich <nnk@google.com> Wed Apr 30 19:28:01 2014 +0000
tree ad4c44d911fdaeabe0320d6a889e8eb384db3019
parent 6838cd54e70869643c54cd0a530defbe4dafca41

Allow shell debugfs read access

Developers should be able to use systrace with user builds.
This requires read access to /sys/kernel/debug/tracing/trace,
otherwise the following error occurs:

  $ atrace
  capturing trace... done
  TRACE:
  error opening /sys/kernel/debug/tracing/trace: Permission denied (13)

with the following SELinux denial:

  <4>[   79.830542] type=1400 audit(11940551.039:8): avc:  denied  { read } for  pid=1156 comm="atrace" name="trace" dev="debugfs" ino=3024 scontext=u:r:shell:s0 tcontext=u:object_r:debugfs:s0 tclass=file

At least on the kernel I've tested this on, debugfs doesn't support
setting SELinux file labels. Grant read access to all of debugfs to
work around this limitation.

Bug: 13904660
Change-Id: Ib58e98972c5012e9b34fec9e0a6094641638cd9a

shelldomain.te

diff --git a/shelldomain.te b/shelldomain.te
index e894d9d..0a86426 100644
--- a/shelldomain.te
+++ b/shelldomain.te
@@ -25,3 +25,10 @@
 allow shelldomain ctl_dumpstate_prop:property_service set;
 allow shelldomain debug_prop:property_service set;
 allow shelldomain powerctl_prop:property_service set;
+
+# systrace support - allow atrace to run
+# debugfs doesn't support labeling individual files, so we have
+# to grant read access to all of /sys/kernel/debug.
+# Directory read access and file write access is already granted
+# in domain.te.
+allow shelldomain debugfs:file r_file_perms;