Handle denials caused by taking a bugreport.
apex_service is already in the list of services dumpstate cannot find;
this ensures that the dontaudit list is the same. We hide the denial
caused by df reading one of its directories.
dumpstate can already call all binder services, so we enable it to
call bufferhubd.
Bug: 116711254
Test: cts-tradefed run cts -m CtsSecurityHostTestCases -t android.security.cts.SELinuxHostTest#testNoBugreportDenials
Change-Id: Ie5acc84326fa504199221df825549479f3cf50e1
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 79faafa..3b5c5eb 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -216,6 +216,7 @@
}:service_manager find;
# suppress denials for services dumpstate should not be accessing.
dontaudit dumpstate {
+ apex_service
dumpstate_service
gatekeeper_service
incident_service
@@ -272,6 +273,10 @@
# For when dumpstate runs df
dontaudit dumpstate mnt_vendor_file:dir search;
+dontaudit dumpstate apex_mnt_dir:dir getattr;
+
+# Allow dumpstate to talk to bufferhubd over binder
+binder_call(dumpstate, bufferhubd);
# Allow dumpstate to kill vendor dumpstate service by init
set_prop(dumpstate, ctl_dumpstate_prop)