commit 2c8ca45d2dd60ce40b236d7f35b41801744da0da
author Carmen Jackson <carmenjackson@google.com> Tue Jan 30 18:14:45 2018 -0800
committer Carmen Jackson <carmenjackson@google.com> Mon Feb 05 10:03:06 2018 -0800
tree c59170821e7258851ca2e1b51d17e7f45e6cc58e
parent de04528c3bb6f0c9aa405635f647b7b118d49806

Use a whitelisting strategy for tracefs.

This changes tracefs files to be default-enabled in debug mode, but
default-disabled with specific files enabled in user mode.

Bug: 64762598
Test: Successfully took traces in user mode.

Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb

private/atrace.te

diff --git a/private/atrace.te b/private/atrace.te
index fc27517..3d7902f 100644
--- a/private/atrace.te
+++ b/private/atrace.te
@@ -14,6 +14,7 @@
   # Allow atrace to access tracefs.
   allow atrace debugfs_tracing:dir r_dir_perms;
   allow atrace debugfs_tracing:file rw_file_perms;
+  allow atrace debugfs_tracing_debug:dir r_dir_perms;
   allow atrace debugfs_tracing_debug:file rw_file_perms;
   allow atrace debugfs_trace_marker:file getattr;