Add rules for lpdump and lpdumpd
- lpdump is a binary on the device that talks to lpdumpd
via binder.
- lpdumpd is a daemon on the device that actually reads
dynamic partition metadata. Only lpdump can talk to it.
Bug: 126233777
Test: boots (sanity)
Test: lpdump
Change-Id: I0e21f35ac136bcbb0603940364e8117f2d6ac438
diff --git a/private/atrace.te b/private/atrace.te
index 7979fa1..0cdd35a 100644
--- a/private/atrace.te
+++ b/private/atrace.te
@@ -45,6 +45,7 @@
-dumpstate_service
-installd_service
-vold_service
+ -lpdump_service
}:service_manager { find };
allow atrace servicemanager:service_manager list;
diff --git a/private/compat/28.0/28.0.ignore.cil b/private/compat/28.0/28.0.ignore.cil
index 40a001f..8187e29 100644
--- a/private/compat/28.0/28.0.ignore.cil
+++ b/private/compat/28.0/28.0.ignore.cil
@@ -84,6 +84,10 @@
llkd_prop
llkd_tmpfs
looper_stats_service
+ lpdumpd
+ lpdumpd_exec
+ lpdumpd_prop
+ lpdump_service
iorapd
iorapd_exec
iorapd_data_file
diff --git a/private/file_contexts b/private/file_contexts
index a3723e2..35796fb 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -262,6 +262,7 @@
/system/bin/usbd u:object_r:usbd_exec:s0
/system/bin/inputflinger u:object_r:inputflinger_exec:s0
/system/bin/logd u:object_r:logd_exec:s0
+/system/bin/lpdumpd u:object_r:lpdumpd_exec:s0
/system/bin/rss_hwm_reset u:object_r:rss_hwm_reset_exec:s0
/system/bin/perfetto u:object_r:perfetto_exec:s0
/system/bin/traced u:object_r:traced_exec:s0
diff --git a/private/lpdumpd.te b/private/lpdumpd.te
new file mode 100644
index 0000000..9acd22b
--- /dev/null
+++ b/private/lpdumpd.te
@@ -0,0 +1,45 @@
+type lpdumpd, domain, coredomain;
+type lpdumpd_exec, system_file_type, exec_type, file_type;
+
+init_daemon_domain(lpdumpd)
+
+# Allow lpdumpd to register itself as a service.
+binder_use(lpdumpd)
+add_service(lpdumpd, lpdump_service)
+
+# Allow lpdumpd to find the super partition block device.
+allow lpdumpd block_device:dir r_dir_perms;
+
+# Allow lpdumpd to read super partition metadata. This may live on
+# super_block_device, or system_block_device (on retrofit devices).
+allow lpdumpd {
+ super_block_device
+ system_block_device
+}:blk_file r_file_perms;
+
+# Allow lpdumpd to read fstab.
+allow lpdumpd sysfs_dt_firmware_android:dir r_dir_perms;
+allow lpdumpd sysfs_dt_firmware_android:file r_file_perms;
+
+# Triggered when lpdumpd tries to read default fstab.
+dontaudit lpdumpd metadata_file:dir r_dir_perms;
+dontaudit lpdumpd metadata_file:file r_file_perms;
+dontaudit lpdumpd gsi_metadata_file:dir r_dir_perms;
+dontaudit lpdumpd gsi_metadata_file:file r_file_perms;
+
+### Neverallow rules
+
+# Disallow other domains to get lpdump_service and call lpdumpd.
+neverallow {
+ domain
+ -dumpstate
+ -lpdumpd
+ -shell
+} lpdump_service:service_manager find;
+
+neverallow {
+ domain
+ -dumpstate
+ -lpdumpd
+ -shell
+} lpdumpd:binder call;
diff --git a/private/property_contexts b/private/property_contexts
index 3261014..3622d12 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -23,6 +23,7 @@
ro.hw. u:object_r:system_prop:s0
sys. u:object_r:system_prop:s0
sys.cppreopt u:object_r:cppreopt_prop:s0
+sys.lpdumpd u:object_r:lpdumpd_prop:s0
sys.powerctl u:object_r:powerctl_prop:s0
sys.usb.ffs. u:object_r:ffs_prop:s0
service. u:object_r:system_prop:s0
diff --git a/private/service_contexts b/private/service_contexts
index 7ee4827..de56972 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -103,6 +103,7 @@
location u:object_r:location_service:s0
lock_settings u:object_r:lock_settings_service:s0
looper_stats u:object_r:looper_stats_service:s0
+lpdump_service u:object_r:lpdump_service:s0
media.aaudio u:object_r:audioserver_service:s0
media.audio_flinger u:object_r:audioserver_service:s0
media.audio_policy u:object_r:audioserver_service:s0
diff --git a/private/shell.te b/private/shell.te
index 0d1cf03..02b01f5 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -70,3 +70,7 @@
# Renderscript host side tests depend on being able to execute
# /system/bin/bcc (b/126388046)
allow shell rs_exec:file rx_file_perms;
+
+# Allow shell to start and comminicate with lpdumpd.
+set_prop(shell, lpdumpd_prop);
+binder_call(shell, lpdumpd)
diff --git a/private/system_app.te b/private/system_app.te
index 9a5e455..05831a3 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -80,6 +80,7 @@
-installd_service
-iorapd_service
-ipmemorystore_service
+ -lpdump_service
-netd_service
-system_suspend_control_service
-virtual_touchpad_service