Grant sigkill for dumpstate on su
On userdebug and eng, dumpstate may use su for specific commands. If the
command fails or times out, dumpstate needs the right to terminate and
kill that process.
From the bug logs:
dumpstate: command '/system/xbin/su root lshal --all --types=all': Error after 0.0067s (killing pid 8505)
avc: denied { sigkill } for comm="dumpstate_2" scontext=u:r:dumpstate:s0 tcontext=u:r:su:s0 tclass=process permissive=0
Note that signal was already granted on su because the su domain has the
appdomain attribute. Explicitly grant the permission nevertheless.
Bug: 346813832
Bug: 220019932
Test: TH
Change-Id: I8c0611845790daaf0143b4b0ca29995e12dc1915
diff --git a/private/dumpstate.te b/private/dumpstate.te
index 6d5f0b3..38ea999 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -258,6 +258,12 @@
system_suspend_server
}:process signal;
+# On userdebug, dumpstate may fork and execute a command as su. Make sure the
+# timeout logic is allowed to terminate the child process if necessary.
+userdebug_or_eng(`
+ allow dumpstate su:process { signal sigkill };
+')
+
# Connect to tombstoned to intercept dumps.
unix_socket_connect(dumpstate, tombstoned_intercept, tombstoned)