Merge "dumpstate: assert no process ptrace"
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 2ba0e58..ac81ccc 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -195,6 +195,10 @@
### neverallow rules
###
+# dumpstate has capability sys_ptrace, but should only use that capability for
+# accessing sensitive /proc/PID files, never for using ptrace attach.
+neverallow dumpstate *:process ptrace;
+
# only system_server, dumpstate and shell can find the dumpstate service
neverallow { domain -system_server -shell -dumpstate } dumpstate_service:service_manager find;