Allow system_server to execute timeout.
We've seen evidence that the logcat binary can end up wedged, which
means we can eventually starve system_server for FDs. To mitigate
this, wrap logcat using the timeout utility to kill and clean up if
it takes too long to exit.
avc: denied { execute } for name="toybox" dev="mmcblk0p43" ino=457 scontext=u:r:system_server:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file permissive=1
avc: denied { read open } for path="/system/bin/toybox" dev="mmcblk0p43" ino=457 scontext=u:r:system_server:s0tcontext=u:object_r:toolbox_exec:s0 tclass=file permissive=1
avc: denied { execute_no_trans } for path="/system/bin/toybox" dev="mmcblk0p43" ino=457 scontext=u:r:system_server:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file permissive=1
Bug: 27994717, 28021719, 28009200
Change-Id: I76d3c7fe5b37fb9a144a3e5dbcc9150dfea495ee
diff --git a/system_server.te b/system_server.te
index 8d8c303..ac27256 100644
--- a/system_server.te
+++ b/system_server.te
@@ -497,6 +497,9 @@
# accesses to the underlying FS.
allow system_server media_rw_data_file:dir search;
+# Allow invoking tools like "timeout"
+allow system_server toolbox_exec:file rx_file_perms;
+
###
### Neverallow rules
###