In native coverage builds, allow all domains to access /data/misc/trace
Bug: http://b/135139675
Coverage files are written to /data/misc/trace (governed by the
method_trace_data_file selinux type). Allow all domains to access
(create directories, access files) this directory when native coverage
is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng
build.
Also relax neverallow constraints to allow access to
method_trace_data_file for native coverage builds.
Test: Build 32-bit cuttlefish with coverage:
m NATIVE_COVERAGE=true COVERAGE_PATHS="*"
and verify that there are no selinux denials in kernel log and
logcat.
Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
diff --git a/private/logd.te b/private/logd.te
index 321727b..ca92e20 100644
--- a/private/logd.te
+++ b/private/logd.te
@@ -8,6 +8,7 @@
file_type
-runtime_event_log_tags_file
userdebug_or_eng(`-coredump_file -misc_logd_file')
+ with_native_coverage(`-method_trace_data_file')
}:file { create write append };
# protect the event-log-tags file
diff --git a/private/logpersist.te b/private/logpersist.te
index 8cdbd2d..4187627 100644
--- a/private/logpersist.te
+++ b/private/logpersist.te
@@ -19,6 +19,10 @@
')
# logpersist is allowed to write to /data/misc/log for userdebug and eng builds
-neverallow logpersist { file_type userdebug_or_eng(`-misc_logd_file -coredump_file') }:file { create write append };
+neverallow logpersist {
+ file_type
+ userdebug_or_eng(`-misc_logd_file -coredump_file')
+ with_native_coverage(`-method_trace_data_file')
+}:file { create write append };
neverallow { domain -init userdebug_or_eng(`-logpersist -logd -dumpstate') } misc_logd_file:file no_rw_file_perms;
neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };
diff --git a/private/perfetto.te b/private/perfetto.te
index d1e2b13..419c4b9 100644
--- a/private/perfetto.te
+++ b/private/perfetto.te
@@ -74,8 +74,14 @@
-vendor_data_file
-zoneinfo_data_file
-perfetto_traces_data_file
+ with_native_coverage(`-method_trace_data_file')
}:dir *;
neverallow perfetto { system_data_file -perfetto_traces_data_file }:dir ~{ getattr search };
neverallow perfetto zoneinfo_data_file:dir ~r_dir_perms;
neverallow perfetto { data_file_type -zoneinfo_data_file -perfetto_traces_data_file }:lnk_file *;
-neverallow perfetto { data_file_type -zoneinfo_data_file -perfetto_traces_data_file }:file ~write;
+neverallow perfetto {
+ data_file_type
+ -zoneinfo_data_file
+ -perfetto_traces_data_file
+ with_native_coverage(`-method_trace_data_file')
+}:file ~write;
diff --git a/private/recovery_persist.te b/private/recovery_persist.te
index 2d244fd..7cb2e67 100644
--- a/private/recovery_persist.te
+++ b/private/recovery_persist.te
@@ -3,4 +3,9 @@
init_daemon_domain(recovery_persist)
# recovery_persist is not allowed to write anywhere other than recovery_data_file
-neverallow recovery_persist { file_type -recovery_data_file userdebug_or_eng(`-coredump_file') }:file write;
+neverallow recovery_persist {
+ file_type
+ -recovery_data_file
+ userdebug_or_eng(`-coredump_file')
+ with_native_coverage(`-method_trace_data_file')
+}:file write;
diff --git a/private/recovery_refresh.te b/private/recovery_refresh.te
index b6cd56f..3c095cc 100644
--- a/private/recovery_refresh.te
+++ b/private/recovery_refresh.te
@@ -3,4 +3,8 @@
init_daemon_domain(recovery_refresh)
# recovery_refresh is not allowed to write anywhere
-neverallow recovery_refresh { file_type userdebug_or_eng(`-coredump_file') }:file write;
+neverallow recovery_refresh {
+ file_type
+ userdebug_or_eng(`-coredump_file')
+ with_native_coverage(`-method_trace_data_file')
+}:file write;
diff --git a/private/traced.te b/private/traced.te
index 1e2d7d6..2d7d07f 100644
--- a/private/traced.te
+++ b/private/traced.te
@@ -66,6 +66,7 @@
# subsequent neverallow. Currently only getattr and search are allowed.
-vendor_data_file
-zoneinfo_data_file
+ with_native_coverage(`-method_trace_data_file')
}:dir *;
neverallow traced { system_data_file }:dir ~{ getattr search };
neverallow traced zoneinfo_data_file:dir ~r_dir_perms;
@@ -75,6 +76,7 @@
-zoneinfo_data_file
-perfetto_traces_data_file
-trace_data_file
+ with_native_coverage(`-method_trace_data_file')
}:file ~write;
# Only init is allowed to enter the traced domain via exec()
diff --git a/private/traced_probes.te b/private/traced_probes.te
index d8d573a..8746c34 100644
--- a/private/traced_probes.te
+++ b/private/traced_probes.te
@@ -111,11 +111,17 @@
# subsequent neverallow. Currently only getattr and search are allowed.
-vendor_data_file
-zoneinfo_data_file
+ with_native_coverage(`-method_trace_data_file')
}:dir *;
neverallow traced_probes system_data_file:dir ~{ getattr userdebug_or_eng(`open read') search };
neverallow traced_probes zoneinfo_data_file:dir ~r_dir_perms;
neverallow traced_probes { data_file_type -zoneinfo_data_file }:lnk_file *;
-neverallow traced_probes { data_file_type -zoneinfo_data_file -packages_list_file }:file *;
+neverallow traced_probes {
+ data_file_type
+ -zoneinfo_data_file
+ -packages_list_file
+ with_native_coverage(`-method_trace_data_file')
+}:file *;
# Only init is allowed to enter the traced_probes domain via exec()
neverallow { domain -init } traced_probes:process transition;