Merge "Let dumpstate get netd stack traces." into qt-dev
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 17f4111..fcdd653 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -339,6 +339,7 @@
# They must use ASharedMemory NDK API instead.
neverallow {
all_untrusted_apps
+ -ephemeral_app
-untrusted_app_25
-untrusted_app_27
} ashmem_device:chr_file open;
diff --git a/private/auditctl.te b/private/auditctl.te
new file mode 100644
index 0000000..f634d3d
--- /dev/null
+++ b/private/auditctl.te
@@ -0,0 +1,18 @@
+#
+# /system/bin/auditctl executed for logd
+#
+# Performs maintenance of the kernel auditing system, including
+# setting rate limits on SELinux denials.
+#
+
+type auditctl, domain, coredomain;
+type auditctl_exec, file_type, system_file_type, exec_type;
+
+# Uncomment the line below to put this domain into permissive
+# mode. This helps speed SELinux policy development.
+# userdebug_or_eng(`permissive auditctl;')
+
+init_daemon_domain(auditctl)
+
+allow auditctl self:global_capability_class_set audit_control;
+allow auditctl self:netlink_audit_socket { create_socket_perms_no_ioctl nlmsg_write };
diff --git a/private/ephemeral_app.te b/private/ephemeral_app.te
index a94c637..1283e21 100644
--- a/private/ephemeral_app.te
+++ b/private/ephemeral_app.te
@@ -65,7 +65,7 @@
allow ephemeral_app system_server:udp_socket {
connect getattr read recvfrom sendto write getopt setopt };
-allow ephemeral_app ashmem_device:chr_file { getattr read ioctl lock map append write };
+allow ephemeral_app ashmem_device:chr_file rw_file_perms;
###
### neverallow rules
diff --git a/private/file_contexts b/private/file_contexts
index f3f367b..a42041a 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -182,6 +182,7 @@
/system/lib(64)?(/.*)? u:object_r:system_lib_file:s0
/system/bin/atrace u:object_r:atrace_exec:s0
/system/bin/ashmemd u:object_r:ashmemd_exec:s0
+/system/bin/auditctl u:object_r:auditctl_exec:s0
/system/bin/bcc u:object_r:rs_exec:s0
/system/bin/blank_screen u:object_r:blank_screen_exec:s0
/system/bin/charger u:object_r:charger_exec:s0
@@ -451,6 +452,8 @@
/data/mediadrm(/.*)? u:object_r:media_data_file:s0
/data/nativetest(/.*)? u:object_r:nativetest_data_file:s0
/data/nativetest64(/.*)? u:object_r:nativetest_data_file:s0
+# This directory was removed after Q Beta 2, but we need to preserve labels for upgrading devices.
+/data/pkg_staging(/.*)? u:object_r:staging_data_file:s0
/data/property(/.*)? u:object_r:property_data_file:s0
/data/preloads(/.*)? u:object_r:preloads_data_file:s0
/data/preloads/media(/.*)? u:object_r:preloads_media_file:s0
diff --git a/private/perfetto.te b/private/perfetto.te
index 128205b..28ea868 100644
--- a/private/perfetto.te
+++ b/private/perfetto.te
@@ -11,6 +11,13 @@
# Allow to access traced's privileged consumer socket.
unix_socket_connect(perfetto, traced_consumer, traced)
+# Connect to the Perfetto traced daemon as a producer. This requires
+# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
+allow perfetto traced:fd use;
+allow perfetto traced_tmpfs:file { read write getattr map };
+unix_socket_connect(perfetto, traced_producer, traced)
+
+
# Allow to write and unlink traces into /data/misc/perfetto-traces.
allow perfetto perfetto_traces_data_file:dir rw_dir_perms;
allow perfetto perfetto_traces_data_file:file create_file_perms;
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 2d5e240..3995527 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -81,6 +81,7 @@
hal_graphics_composer_server
hal_health_server
hal_omx_server
+ hal_power_stats_server
hal_sensors_server
hal_vr_server
}:process signal;