commit cbe2d7d714a9218f03cf8ef328234a04cfc5675a
author Treehugger Robot <treehugger-gerrit@google.com> Mon Feb 05 21:56:29 2018 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Mon Feb 05 21:56:29 2018 +0000
tree a956adf2cccc541edb87a4326a04f0705ce4fd58
parent 0fe4586bb139936173f7d76725730eafa2ba6edb
parent d583e5966ef1d13b6688ac3fd0e8ac402549bd52

Merge "lmkd: add live-lock killer daemon"

public/lmkd.te

diff --git a/public/lmkd.te b/public/lmkd.te
index f43e42a..5b6a708 100644
--- a/public/lmkd.te
+++ b/public/lmkd.te
@@ -35,6 +35,14 @@
 
 allow lmkd proc_zoneinfo:file r_file_perms;
 
+# live lock watchdog process allowed to look through /proc/
+allow lmkd domain:dir { search open read };
+allow lmkd domain:file { open read };
+
+# live lock watchdog process allowed to dump process trace and
+# reboot because orderly shutdown may not be possible.
+allow lmkd proc_sysrq:file rw_file_perms;
+
 ### neverallow rules
 
 # never honor LD_PRELOAD