allow traced to read frozen processes from cgroup.freeze
This is to allow the tracing service to read
/sys/fs/cgroup/uid_%d/pid_%d/cgroup.freeze
Traced has already visibility of all the processes, uids
and pids via the trace, so this read permission doesn't
seem to expose any extra information that traced doesn't
have already.
Bug: 381089063
Change-Id: I77210f4278ea516e0210ede79ee014568266e69d
diff --git a/private/traced.te b/private/traced.te
index 796095f..8a29541 100644
--- a/private/traced.te
+++ b/private/traced.te
@@ -53,6 +53,9 @@
userdebug_or_eng(`system_server_tmpfs')
}:file { getattr map read write };
+# Allow traced to detect if a process is frozen (b/381089063).
+allow traced cgroup_v2:file r_file_perms;
+
# Allow setting debug properties which guard initialization of the Perfetto SDK
# in SurfaceFlinger and HWUI's copy of Skia.
# Required for the android.sdk_sysprop_guard data source.