commit c50fecd8efca66e24aa9b42a53a7ddd2888157aa
author David Massoud <davidmassoud@google.com> Fri Apr 16 20:02:06 2021 +0800
committer David Massoud <davidmassoud@google.com> Fri Apr 16 20:02:06 2021 +0800
tree aa8b1edb0dd535d9ac77c0631c09bf0663f351a2
parent f40c8b67ca28ad828fd08220101c062fbcbec2d0

Allow traced_probes to read devfreq

- Add dir read access to /sys/class/devfreq/
- Add file read access to /sys/class/devfreq/$DEVICE/cur_freq

Resolves the following denials:
W traced_probes: type=1400 audit(0.0:8):
avc: denied { read } for name="devfreq" dev="sysfs"
ino=28076 scontext=u:r:traced_probes:s0
tcontext=u:object_r:sysfs:s0 tclass=dir permissive=0

W traced_probes: type=1400 audit(0.0:226):
avc: denied { read } for name="cur_freq" dev="sysfs"
ino=54729 scontext=u:r:traced_probes:s0
tcontext=u:object_r:sysfs:s0 tclass=file permissive=0

See ag/14187061 for device specific sysfs_devfreq_cur labels

Bug: 181850306
Test: ls -Z, record perfetto trace
Change-Id: I23cebb16505313160e14b49e82e24da9b81cad70

private/traced_probes.te

diff --git a/private/traced_probes.te b/private/traced_probes.te
index da9c635..2c4ee9d 100644
--- a/private/traced_probes.te
+++ b/private/traced_probes.te
@@ -82,6 +82,10 @@
   proc_stat
 }:file r_file_perms;
 
+# Allow access to read /sys/class/devfreq/ and /$DEVICE/cur_freq files
+allow traced_probes sysfs_devfreq_dir:dir r_dir_perms;
+allow traced_probes sysfs_devfreq_cur:file r_file_perms;
+
 # Allow access to the IHealth and IPowerStats HAL service for tracing battery counters.
 hal_client_domain(traced_probes, hal_health)
 hal_client_domain(traced_probes, hal_power_stats)