commit ce9c0c5a5fbd3fda8e1fd102d2bf1ca6afebbdf9
author Pirama Arumuga Nainar <pirama@google.com> Thu Jun 13 15:05:15 2019 -0700
committer Pirama Arumuga Nainar <pirama@google.com> Fri Jun 14 08:31:51 2019 -0700
tree c12e939af4130935e4109d473eb388ba95ed692e
parent 0d5455a1117f28a826f94be5b1ca520610d14642

In native coverage builds, allow all domains to access /data/misc/trace

Bug: http://b/135139675

Coverage files are written to /data/misc/trace (governed by the
method_trace_data_file selinux type).  Allow all domains to access
(create directories, access files) this directory when native coverage
is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng
build.

Also relax neverallow constraints to allow access to
method_trace_data_file for native coverage builds.

Test: Build 32-bit cuttlefish with coverage:
          m NATIVE_COVERAGE=true COVERAGE_PATHS="*"
      and verify that there are no selinux denials in kernel log and
      logcat.

Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e

private/recovery_persist.te

diff --git a/private/recovery_persist.te b/private/recovery_persist.te
index 2d244fd..7cb2e67 100644
--- a/private/recovery_persist.te
+++ b/private/recovery_persist.te
@@ -3,4 +3,9 @@
 init_daemon_domain(recovery_persist)
 
 # recovery_persist is not allowed to write anywhere other than recovery_data_file
-neverallow recovery_persist { file_type -recovery_data_file userdebug_or_eng(`-coredump_file') }:file write;
+neverallow recovery_persist {
+  file_type
+  -recovery_data_file
+  userdebug_or_eng(`-coredump_file')
+  with_native_coverage(`-method_trace_data_file')
+}:file write;