Add new "procrank" SELinux domain.
/system/xbin/procrank is a setuid program run by adb shell on
userdebug / eng devices. Allow it to work without running adb root.
Bug: 18342188
Change-Id: I18d9f743e5588c26661eaa26e1b7e6980b15caf7
diff --git a/domain.te b/domain.te
index 733a095..32aa900 100644
--- a/domain.te
+++ b/domain.te
@@ -177,7 +177,14 @@
# Limit ability to ptrace or read sensitive /proc/pid files of processes
# with other UIDs to these whitelisted domains.
-neverallow { domain -debuggerd -vold -dumpstate -system_server } self:capability sys_ptrace;
+neverallow {
+ domain
+ -debuggerd
+ -vold
+ -dumpstate
+ -system_server
+ userdebug_or_eng(`-procrank')
+} self:capability sys_ptrace;
# Limit device node creation to these whitelisted domains.
neverallow { domain -kernel -init -recovery -ueventd -watchdogd -healthd -vold -uncrypt -slideshow } self:capability mknod;
diff --git a/file_contexts b/file_contexts
index ce55cc8..27d5842 100644
--- a/file_contexts
+++ b/file_contexts
@@ -156,6 +156,7 @@
/system/bin/tf_daemon u:object_r:tee_exec:s0
/system/bin/racoon u:object_r:racoon_exec:s0
/system/xbin/su u:object_r:su_exec:s0
+/system/xbin/procrank u:object_r:procrank_exec:s0
/system/vendor/bin/gpsd u:object_r:gpsd_exec:s0
/system/bin/dnsmasq u:object_r:dnsmasq_exec:s0
/system/bin/hostapd u:object_r:hostapd_exec:s0
diff --git a/procrank.te b/procrank.te
new file mode 100644
index 0000000..06b33f8
--- /dev/null
+++ b/procrank.te
@@ -0,0 +1,13 @@
+# File types must be defined for file_contexts.
+type procrank_exec, exec_type, file_type;
+
+userdebug_or_eng(`
+ type procrank, domain, mlstrustedsubject;
+
+ domain_auto_trans(shell, procrank_exec, procrank)
+ allow procrank self:capability sys_ptrace;
+ allow procrank devpts:chr_file { read write getattr ioctl };
+ r_dir_file(procrank, domain)
+ allow procrank shell:fd use;
+ allow procrank adbd:process sigchld;
+')