limit shell's access to log.* properties
Restrict the ability of the shell to set the log.*
properties. Namely: only allow the shell to set
such properities on eng and userdebug builds.
The shell (and other domains) can continue to
read log.* properties on all builds.
While there: harmonize permissions for log.* and
persist.log.tag. Doing so introduces two changes:
- log.* is now writable from from |system_app|. This
mirrors the behavior of persist.log.tag, which is
writable to support "Developer options" ->
"Logger buffer sizes" -> "Off".
(Since this option is visible on user builds, the
permission is enabled for all builds.)
- persist.log.tag can now be set from |shell| on
userdebug_or_eng().
BUG=28221972
TEST=manual (see below)
Testing details
- user build (log.tag)
$ adb shell setprop log.tag.foo V
$ adb shell getprop log.tag
<blank line>
$ adb bugreport | grep log.tag.foo
[ 146.525836] init: avc: denied { set } for property=log.tag.foo pid=4644 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:log_prop:s0 tclass=property_service permissive=0
[ 146.525878] init: sys_prop: permission denied uid:2000 name:log.tag.foo
- userdebug build (log.tag)
$ adb shell getprop log.tag.foo
<blank line>
$ adb shell setprop log.tag.foo V
$ adb shell getprop log.tag.foo
V
- user build (persist.log.tag)
$ adb shell getprop | grep log.tag
<no match>
- Developer options -> Logger buffer sizes -> Off
$ adb shell getprop | grep log.tag
[persist.log.tag]: [Settings]
[persist.log.tag.snet_event_log]: [I]
Change-Id: Idf00e7a623723a7c46bf6d01e386aeca92b2ad75
6 files changed