| Alex Klyubin | f5446eb | 2017-03-23 14:27:32 -0700 | [diff] [blame] | 1 | typeattribute shell coredomain; |
| 2 | |
| Siarhei Vishniakou | 2a7f571 | 2017-05-10 19:37:06 -0700 | [diff] [blame] | 3 | # allow shell input injection |
| 4 | allow shell uhid_device:chr_file rw_file_perms; |
| 5 | |
| dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 6 | # systrace support - allow atrace to run |
| 7 | allow shell debugfs_tracing:dir r_dir_perms; |
| Joel Galenson | 27c0aa7 | 2017-07-26 16:22:50 -0700 | [diff] [blame] | 8 | allow shell debugfs_tracing:file rw_file_perms; |
| dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 9 | allow shell debugfs_trace_marker:file getattr; |
| 10 | allow shell atrace_exec:file rx_file_perms; |
| 11 | |
| Yifan Hong | 19a8773 | 2017-05-08 14:38:45 -0700 | [diff] [blame] | 12 | # read config.gz for CTS purposes |
| 13 | allow shell config_gz:file r_file_perms; |
| 14 | |
| Carmen Jackson | 25788df | 2017-04-14 12:12:50 -0700 | [diff] [blame] | 15 | userdebug_or_eng(` |
| Joel Galenson | 47966ce | 2017-07-27 09:50:25 -0700 | [diff] [blame] | 16 | allow shell debugfs_tracing_debug:file rw_file_perms; |
| Carmen Jackson | 25788df | 2017-04-14 12:12:50 -0700 | [diff] [blame] | 17 | ') |
| 18 | |
| dcashman | 3e8dbf0 | 2016-12-08 11:23:34 -0800 | [diff] [blame] | 19 | # Run app_process. |
| 20 | # XXX Transition into its own domain? |
| 21 | app_domain(shell) |
| Jin Qian | a239f30 | 2017-03-23 12:28:20 -0700 | [diff] [blame] | 22 | |
| 23 | # allow shell to call dumpsys storaged |
| 24 | binder_call(shell, storaged) |
| Nick Kralevich | 14e2e92 | 2017-05-08 09:51:59 -0700 | [diff] [blame] | 25 | |
| 26 | # Perform SELinux access checks, needed for CTS |
| 27 | selinux_check_access(shell) |
| 28 | selinux_check_context(shell) |
| Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 29 | |
| 30 | # Control Perfetto traced and obtain traces from it. |
| 31 | # Needed for Studio and debugging. |
| 32 | unix_socket_connect(shell, traced_consumer, traced) |
| 33 | |
| 34 | # Allow shell binaries to write trace data to Perfetto. Used for testing and |
| 35 | # cmdline utils. |
| 36 | allow shell traced:fd use; |
| 37 | allow shell traced_tmpfs:file { read write getattr map }; |
| 38 | unix_socket_connect(shell, traced_producer, traced) |