Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 1 | # Perfetto tracing probes, has tracefs access. |
Nick Kralevich | 5e37271 | 2018-09-27 10:21:37 -0700 | [diff] [blame] | 2 | type traced_probes_exec, system_file_type, exec_type, file_type; |
Ryan Savitski | 21f6ae6 | 2020-02-04 13:44:14 +0000 | [diff] [blame^] | 3 | type traced_probes_tmpfs, file_type; |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 4 | |
| 5 | # Allow init to exec the daemon. |
| 6 | init_daemon_domain(traced_probes) |
Ryan Savitski | 21f6ae6 | 2020-02-04 13:44:14 +0000 | [diff] [blame^] | 7 | tmpfs_domain(traced_probes) |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 8 | |
| 9 | # Write trace data to the Perfetto traced damon. This requires connecting to its |
| 10 | # producer socket and obtaining a (per-process) tmpfs fd. |
Florian Mayer | 5e52281 | 2019-10-08 16:15:14 +0100 | [diff] [blame] | 11 | perfetto_producer(traced_probes) |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 12 | |
| 13 | # Allow traced_probes to access tracefs. |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 14 | allow traced_probes debugfs_tracing:dir r_dir_perms; |
| 15 | allow traced_probes debugfs_tracing:file rw_file_perms; |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 16 | allow traced_probes debugfs_trace_marker:file getattr; |
Primiano Tucci | b4b31f9 | 2018-02-09 11:15:22 +0000 | [diff] [blame] | 17 | |
| 18 | # TODO(primiano): temporarily I/O tracing categories are still |
| 19 | # userdebug only until we nail down the blacklist/whitelist. |
| 20 | userdebug_or_eng(` |
Hector Dearman | 4802cbd | 2018-12-06 18:32:23 +0000 | [diff] [blame] | 21 | allow traced_probes debugfs_tracing_debug:dir r_dir_perms; |
Primiano Tucci | b4b31f9 | 2018-02-09 11:15:22 +0000 | [diff] [blame] | 22 | allow traced_probes debugfs_tracing_debug:file rw_file_perms; |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 23 | ') |
| 24 | |
| 25 | # Allow traced_probes to start with a higher scheduling class and then downgrade |
| 26 | # itself. |
| 27 | allow traced_probes self:global_capability_class_set { sys_nice }; |
| 28 | |
| 29 | # Allow procfs access |
| 30 | r_dir_file(traced_probes, domain) |
| 31 | |
Florian Mayer | d04ffff | 2019-04-02 16:19:09 +0100 | [diff] [blame] | 32 | # Allow to read packages.list file. |
| 33 | allow traced_probes packages_list_file:file r_file_perms; |
| 34 | |
Primiano Tucci | d807d58 | 2018-02-16 13:54:41 +0000 | [diff] [blame] | 35 | # Allow to log to kernel dmesg when starting / stopping ftrace. |
| 36 | allow traced_probes kmsg_device:chr_file write; |
| 37 | |
Florian Mayer | ef6358b | 2018-02-23 16:47:38 +0000 | [diff] [blame] | 38 | # Allow traced_probes to list the system partition. |
| 39 | allow traced_probes system_file:dir { open read }; |
| 40 | |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 41 | # Allow traced_probes to list some of the data partition. |
Benjamin Gordon | 7ed266c | 2018-08-15 13:34:20 -0600 | [diff] [blame] | 42 | allow traced_probes self:global_capability_class_set dac_read_search; |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 43 | |
Florian Mayer | ff14696 | 2018-04-06 12:55:22 +0100 | [diff] [blame] | 44 | allow traced_probes apk_data_file:dir { getattr open read search }; |
| 45 | allow traced_probes dalvikcache_data_file:dir { getattr open read search }; |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 46 | userdebug_or_eng(` |
Florian Mayer | d04ffff | 2019-04-02 16:19:09 +0100 | [diff] [blame] | 47 | # search and getattr are granted via domain and coredomain, respectively. |
| 48 | allow traced_probes system_data_file:dir { open read }; |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 49 | ') |
Florian Mayer | ff14696 | 2018-04-06 12:55:22 +0100 | [diff] [blame] | 50 | allow traced_probes system_app_data_file:dir { getattr open read search }; |
| 51 | allow traced_probes backup_data_file:dir { getattr open read search }; |
| 52 | allow traced_probes bootstat_data_file:dir { getattr open read search }; |
| 53 | allow traced_probes update_engine_data_file:dir { getattr open read search }; |
| 54 | allow traced_probes update_engine_log_data_file:dir { getattr open read search }; |
| 55 | allow traced_probes user_profile_data_file:dir { getattr open read search }; |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 56 | |
Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 57 | # Allow traced_probes to run atrace. atrace pokes at system services to enable |
| 58 | # their userspace TRACE macros. |
| 59 | domain_auto_trans(traced_probes, atrace_exec, atrace); |
| 60 | |
Lalit Maganti | d6ae1a5 | 2018-11-16 12:17:24 +0000 | [diff] [blame] | 61 | # Allow traced_probes to kill atrace on timeout. |
| 62 | allow traced_probes atrace:process sigkill; |
Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 63 | |
Primiano Tucci | 51dc7cb | 2018-09-18 08:51:06 +0100 | [diff] [blame] | 64 | # Allow traced_probes to access /proc files for system stats. |
| 65 | # Note: trace data is NOT exposed to anything other than shell and privileged |
| 66 | # system apps that have access to the traced consumer socket. |
| 67 | allow traced_probes { |
| 68 | proc_meminfo |
| 69 | proc_vmstat |
| 70 | proc_stat |
| 71 | }:file r_file_perms; |
| 72 | |
Ben Murdoch | f948ea5 | 2019-03-13 17:08:43 +0000 | [diff] [blame] | 73 | # Allow access to the IHealth and IPowerStats HAL service for tracing battery counters. |
Primiano Tucci | 353b93a | 2018-12-02 21:59:10 +0000 | [diff] [blame] | 74 | hal_client_domain(traced_probes, hal_health) |
Ben Murdoch | f948ea5 | 2019-03-13 17:08:43 +0000 | [diff] [blame] | 75 | hal_client_domain(traced_probes, hal_power_stats) |
Primiano Tucci | 353b93a | 2018-12-02 21:59:10 +0000 | [diff] [blame] | 76 | |
Isabelle Taylor | e8c4ba8 | 2019-03-26 11:03:35 +0000 | [diff] [blame] | 77 | # Allow access to Atrace HAL for enabling vendor/device specific tracing categories. |
| 78 | hal_client_domain(traced_probes, hal_atrace) |
| 79 | |
Primiano Tucci | a64d5bb | 2019-01-10 20:07:51 +0000 | [diff] [blame] | 80 | # On debug builds allow to ingest system logs into the trace. |
| 81 | userdebug_or_eng(`read_logd(traced_probes)') |
| 82 | |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 83 | ### |
| 84 | ### Neverallow rules |
| 85 | ### |
| 86 | ### traced_probes should NEVER do any of this |
| 87 | |
| 88 | # Disallow mapping executable memory (execstack and exec are already disallowed |
| 89 | # globally in domain.te). |
| 90 | neverallow traced_probes self:process execmem; |
| 91 | |
| 92 | # Block device access. |
| 93 | neverallow traced_probes dev_type:blk_file { read write }; |
| 94 | |
| 95 | # ptrace any other app |
| 96 | neverallow traced_probes domain:process ptrace; |
| 97 | |
| 98 | # Disallows access to /data files. |
Primiano Tucci | d807d58 | 2018-02-16 13:54:41 +0000 | [diff] [blame] | 99 | neverallow traced_probes { |
Jeff Vander Stoep | d25ccab | 2018-02-07 16:29:06 -0800 | [diff] [blame] | 100 | data_file_type |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 101 | -apk_data_file |
| 102 | -dalvikcache_data_file |
Jeff Vander Stoep | d25ccab | 2018-02-07 16:29:06 -0800 | [diff] [blame] | 103 | -system_data_file |
Paul Crowley | aed0f76 | 2019-08-01 15:57:47 -0700 | [diff] [blame] | 104 | -system_data_root_file |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 105 | -system_app_data_file |
| 106 | -backup_data_file |
| 107 | -bootstat_data_file |
| 108 | -update_engine_data_file |
| 109 | -update_engine_log_data_file |
| 110 | -user_profile_data_file |
Jeff Vander Stoep | d25ccab | 2018-02-07 16:29:06 -0800 | [diff] [blame] | 111 | # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a |
| 112 | # subsequent neverallow. Currently only getattr and search are allowed. |
| 113 | -vendor_data_file |
| 114 | -zoneinfo_data_file |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 115 | with_native_coverage(`-method_trace_data_file') |
Jeff Vander Stoep | d25ccab | 2018-02-07 16:29:06 -0800 | [diff] [blame] | 116 | }:dir *; |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 117 | neverallow traced_probes system_data_file:dir ~{ getattr userdebug_or_eng(`open read') search }; |
Primiano Tucci | d807d58 | 2018-02-16 13:54:41 +0000 | [diff] [blame] | 118 | neverallow traced_probes zoneinfo_data_file:dir ~r_dir_perms; |
| 119 | neverallow traced_probes { data_file_type -zoneinfo_data_file }:lnk_file *; |
Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 120 | neverallow traced_probes { |
| 121 | data_file_type |
| 122 | -zoneinfo_data_file |
| 123 | -packages_list_file |
| 124 | with_native_coverage(`-method_trace_data_file') |
| 125 | }:file *; |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 126 | |
| 127 | # Only init is allowed to enter the traced_probes domain via exec() |
| 128 | neverallow { domain -init } traced_probes:process transition; |
| 129 | neverallow * traced_probes:process dyntransition; |