Merge "Add missing services to service_contexts."
diff --git a/dumpstate.te b/dumpstate.te
index e4d6dc9..2221222 100644
--- a/dumpstate.te
+++ b/dumpstate.te
@@ -49,8 +49,8 @@
# This list comes from native_processes_to_dump in dumpstate/utils.c
allow dumpstate { drmserver mediaserver sdcardd surfaceflinger }:process signal;
-# The vdc command needs to talk to the vold socket.
-unix_socket_connect(dumpstate, vold, vold)
+# Execute and transition to the vdc domain
+domain_auto_trans(dumpstate, vdc_exec, vdc)
# Vibrate the device after we're done collecting the bugreport
# /sys/class/timed_output/vibrator/enable
diff --git a/system_server.te b/system_server.te
index 619e5f9..726ea8c 100644
--- a/system_server.te
+++ b/system_server.te
@@ -77,19 +77,14 @@
allow system_server appdomain:process { getsched setsched };
allow system_server mediaserver:process { getsched setsched };
-# Read /proc/pid data for apps.
-r_dir_file(system_server, appdomain)
+# Read /proc/pid data for all domains. This is used by ProcessCpuTracker
+# within system_server to keep track of memory and CPU usage for
+# all processes on the device.
+r_dir_file(system_server, domain)
# Write to /proc/pid/oom_adj_score for apps.
allow system_server appdomain:file write;
-# Silently deny access to any /proc/pid files other than
-# the ones allowed via allow rule. Avoids filling the logs
-# with noise from /proc/pid traversals by ActivityManager,
-# CpuTracker, and possibly other system_server components.
-dontaudit system_server domain:dir r_dir_perms;
-dontaudit system_server domain:{ file lnk_file } r_file_perms;
-
# Read/Write to /proc/net/xt_qtaguid/ctrl and and /dev/xt_qtaguid.
allow system_server qtaguid_proc:file rw_file_perms;
allow system_server qtaguid_device:chr_file rw_file_perms;
diff --git a/vdc.te b/vdc.te
index a5ca2f2..8b6a93a 100644
--- a/vdc.te
+++ b/vdc.te
@@ -1,6 +1,9 @@
# vdc spawned from init for the following services:
# defaultcrypto
# encrypt
+#
+# We also transition into this domain from dumpstate, when
+# collecting bug reports.
type vdc, domain;
type vdc_exec, exec_type, file_type;
@@ -8,3 +11,13 @@
init_daemon_domain(vdc)
unix_socket_connect(vdc, vold, vold)
+
+# vdc sends information back to dumpstate when "adb bugreport" is used
+allow vdc dumpstate:fd use;
+allow vdc dumpstate:unix_stream_socket { read write getattr };
+
+# vdc information is written to shell owned bugreport files
+allow vdc shell_data_file:file { write getattr };
+
+# Why?
+allow vdc dumpstate:unix_dgram_socket { read write };