Label kprobes and restrict access
Bug: 149659981
Test: build
Change-Id: I6abcd1bb9af15e7ba0f1f5e711ea9ac661bffc25
diff --git a/private/compat/30.0/30.0.ignore.cil b/private/compat/30.0/30.0.ignore.cil
index 4c444d3..8a6c602 100644
--- a/private/compat/30.0/30.0.ignore.cil
+++ b/private/compat/30.0/30.0.ignore.cil
@@ -6,4 +6,5 @@
(typeattributeset new_objects
( new_objects
apex_info_file
+ debugfs_kprobes
gnss_device))
diff --git a/private/domain.te b/private/domain.te
index d563267..9cd064a 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -365,3 +365,6 @@
# Do not allow reading the last boot timestamp from system properties
neverallow { domain -init -system_server -dumpstate } firstboot_prop:file r_file_perms;
+
+# Kprobes should only be used by adb root
+neverallow { domain -init -vendor_init } debugfs_kprobes:file *;
diff --git a/private/genfs_contexts b/private/genfs_contexts
index b423e64..25de730 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -151,6 +151,7 @@
genfscon sysfs /module/wlan/parameters/fwpath u:object_r:sysfs_wlan_fwpath:s0
genfscon sysfs /devices/virtual/timed_output/vibrator/enable u:object_r:sysfs_vibrator:s0
+genfscon debugfs /kprobes u:object_r:debugfs_kprobes:s0
genfscon debugfs /mmc0 u:object_r:debugfs_mmc:s0
genfscon debugfs /tracing u:object_r:debugfs_tracing_debug:s0
genfscon tracefs / u:object_r:debugfs_tracing_debug:s0