Merge "Rules for new installd Binder interface."
diff --git a/public/debuggerd.te b/public/debuggerd.te
index 33f8878..0222e34 100644
--- a/public/debuggerd.te
+++ b/public/debuggerd.te
@@ -15,9 +15,15 @@
-healthd
-init
-keystore
+ -logd
-ueventd
-watchdogd
}:process { execmem ptrace getattr };
+
+userdebug_or_eng(`
+ allow debuggerd logd:process { execmem ptrace getattr };
+')
+
allow debuggerd tombstone_data_file:dir rw_dir_perms;
allow debuggerd tombstone_data_file:file create_file_perms;
allow debuggerd shared_relro_file:dir r_dir_perms;
diff --git a/public/logd.te b/public/logd.te
index 3e6f7b6..a35be5c 100644
--- a/public/logd.te
+++ b/public/logd.te
@@ -48,6 +48,9 @@
# ptrace any other app
neverallow logd domain:process ptrace;
+# ... and nobody may ptrace me (except on userdebug or eng builds)
+neverallow { domain userdebug_or_eng(`-debuggerd') } logd:process ptrace;
+
# Write to /system.
neverallow logd system_file:dir_file_class_set write;