Define debuggerd class, permissions, and rules.
Define a new class, permissions, and rules for the debuggerd
SELinux MAC checks.
Used by Ib317564e54e07cc21f259e75124b762ad17c6e16 for debuggerd.
Change-Id: I8e120d319512ff207ed22ed87cde4e0432a13dda
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
diff --git a/access_vectors b/access_vectors
index 5e78341..1b26bce 100644
--- a/access_vectors
+++ b/access_vectors
@@ -915,3 +915,9 @@
duplicate
clear_uid
}
+
+class debuggerd
+{
+ dump_tombstone
+ dump_backtrace
+}
diff --git a/debuggerd.te b/debuggerd.te
index 6bbeac4..22afe63 100644
--- a/debuggerd.te
+++ b/debuggerd.te
@@ -9,7 +9,7 @@
allow debuggerd domain:dir r_dir_perms;
allow debuggerd domain:file r_file_perms;
allow debuggerd domain:lnk_file read;
-allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process ptrace;
+allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process { ptrace getattr };
security_access_policy(debuggerd)
allow debuggerd system_data_file:dir create_dir_perms;
allow debuggerd system_data_file:dir relabelfrom;
@@ -31,3 +31,6 @@
# logd access
read_logd(debuggerd)
+
+# Check SELinux permissions.
+selinux_check_access(debuggerd)
diff --git a/security_classes b/security_classes
index fcee928..ca8f468 100644
--- a/security_classes
+++ b/security_classes
@@ -143,4 +143,7 @@
# Keystore Key
class keystore_key # userspace
+# debuggerd service
+class debuggerd # userspace
+
# FLASK
diff --git a/system_server.te b/system_server.te
index 9d973db..9d3dfa1 100644
--- a/system_server.te
+++ b/system_server.te
@@ -127,6 +127,9 @@
binder_call(system_server, dumpstate)
binder_service(system_server)
+# Ask debuggerd to dump backtraces for native stacks of interest.
+allow system_server { mediaserver sdcardd surfaceflinger inputflinger }:debuggerd dump_backtrace;
+
# Read /proc/pid files for dumping stack traces of native processes.
r_dir_file(system_server, mediaserver)
r_dir_file(system_server, sdcardd)