blob: e17329363ee5eb0c2b674a21939f2166d13542fd [file] [log] [blame]
Primiano Tuccic80f9e02017-12-21 03:51:15 +01001# Perfetto tracing probes, has tracefs access.
Nick Kralevich5e372712018-09-27 10:21:37 -07002type traced_probes_exec, system_file_type, exec_type, file_type;
Primiano Tuccic80f9e02017-12-21 03:51:15 +01003
4# Allow init to exec the daemon.
5init_daemon_domain(traced_probes)
6
7# Write trace data to the Perfetto traced damon. This requires connecting to its
8# producer socket and obtaining a (per-process) tmpfs fd.
9allow traced_probes traced:fd use;
10allow traced_probes traced_tmpfs:file { read write getattr map };
11unix_socket_connect(traced_probes, traced_producer, traced)
12
13# Allow traced_probes to access tracefs.
Primiano Tuccic80f9e02017-12-21 03:51:15 +010014allow traced_probes debugfs_tracing:dir r_dir_perms;
15allow traced_probes debugfs_tracing:file rw_file_perms;
Primiano Tuccic80f9e02017-12-21 03:51:15 +010016allow traced_probes debugfs_trace_marker:file getattr;
Primiano Tuccib4b31f92018-02-09 11:15:22 +000017
18# TODO(primiano): temporarily I/O tracing categories are still
19# userdebug only until we nail down the blacklist/whitelist.
20userdebug_or_eng(`
21allow traced_probes debugfs_tracing_debug:file rw_file_perms;
Primiano Tuccic80f9e02017-12-21 03:51:15 +010022')
23
24# Allow traced_probes to start with a higher scheduling class and then downgrade
25# itself.
26allow traced_probes self:global_capability_class_set { sys_nice };
27
28# Allow procfs access
29r_dir_file(traced_probes, domain)
30
Primiano Tuccid807d582018-02-16 13:54:41 +000031# Allow to log to kernel dmesg when starting / stopping ftrace.
32allow traced_probes kmsg_device:chr_file write;
33
Florian Mayeref6358b2018-02-23 16:47:38 +000034# Allow traced_probes to list the system partition.
35allow traced_probes system_file:dir { open read };
36
Florian Mayer9fcf22b2018-03-02 10:52:56 +000037# Allow traced_probes to list some of the data partition.
Benjamin Gordon7ed266c2018-08-15 13:34:20 -060038allow traced_probes self:global_capability_class_set dac_read_search;
Florian Mayer9fcf22b2018-03-02 10:52:56 +000039
Florian Mayerff146962018-04-06 12:55:22 +010040allow traced_probes apk_data_file:dir { getattr open read search };
41allow traced_probes dalvikcache_data_file:dir { getattr open read search };
Florian Mayer9fcf22b2018-03-02 10:52:56 +000042userdebug_or_eng(`
Florian Mayerff146962018-04-06 12:55:22 +010043allow traced_probes system_data_file:dir { getattr open read search };
Florian Mayer9fcf22b2018-03-02 10:52:56 +000044')
Florian Mayerff146962018-04-06 12:55:22 +010045allow traced_probes system_app_data_file:dir { getattr open read search };
46allow traced_probes backup_data_file:dir { getattr open read search };
47allow traced_probes bootstat_data_file:dir { getattr open read search };
48allow traced_probes update_engine_data_file:dir { getattr open read search };
49allow traced_probes update_engine_log_data_file:dir { getattr open read search };
50allow traced_probes user_profile_data_file:dir { getattr open read search };
Florian Mayer9fcf22b2018-03-02 10:52:56 +000051
Primiano Tuccifeaf22b2018-03-02 19:27:06 +000052# Allow traced_probes to run atrace. atrace pokes at system services to enable
53# their userspace TRACE macros.
54domain_auto_trans(traced_probes, atrace_exec, atrace);
55
56# This is needed for: path="/system/bin/linker64"
57# scontext=u:r:atrace:s0 tcontext=u:r:traced_probes:s0 tclass=fd
58allow atrace traced_probes:fd use;
59
Primiano Tucci51dc7cb2018-09-18 08:51:06 +010060# Allow traced_probes to access /proc files for system stats.
61# Note: trace data is NOT exposed to anything other than shell and privileged
62# system apps that have access to the traced consumer socket.
63allow traced_probes {
64 proc_meminfo
65 proc_vmstat
66 proc_stat
67}:file r_file_perms;
68
Primiano Tuccic80f9e02017-12-21 03:51:15 +010069###
70### Neverallow rules
71###
72### traced_probes should NEVER do any of this
73
74# Disallow mapping executable memory (execstack and exec are already disallowed
75# globally in domain.te).
76neverallow traced_probes self:process execmem;
77
78# Block device access.
79neverallow traced_probes dev_type:blk_file { read write };
80
81# ptrace any other app
82neverallow traced_probes domain:process ptrace;
83
84# Disallows access to /data files.
Primiano Tuccid807d582018-02-16 13:54:41 +000085neverallow traced_probes {
Jeff Vander Stoepd25ccab2018-02-07 16:29:06 -080086 data_file_type
Florian Mayer9fcf22b2018-03-02 10:52:56 +000087 -apk_data_file
88 -dalvikcache_data_file
Jeff Vander Stoepd25ccab2018-02-07 16:29:06 -080089 -system_data_file
Florian Mayer9fcf22b2018-03-02 10:52:56 +000090 -system_app_data_file
91 -backup_data_file
92 -bootstat_data_file
93 -update_engine_data_file
94 -update_engine_log_data_file
95 -user_profile_data_file
Jeff Vander Stoepd25ccab2018-02-07 16:29:06 -080096 # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a
97 # subsequent neverallow. Currently only getattr and search are allowed.
98 -vendor_data_file
99 -zoneinfo_data_file
100}:dir *;
Florian Mayer9fcf22b2018-03-02 10:52:56 +0000101neverallow traced_probes system_data_file:dir ~{ getattr userdebug_or_eng(`open read') search };
Primiano Tuccid807d582018-02-16 13:54:41 +0000102neverallow traced_probes zoneinfo_data_file:dir ~r_dir_perms;
103neverallow traced_probes { data_file_type -zoneinfo_data_file }:lnk_file *;
104neverallow traced_probes { data_file_type -zoneinfo_data_file }:file *;
Primiano Tuccic80f9e02017-12-21 03:51:15 +0100105
106# Only init is allowed to enter the traced_probes domain via exec()
107neverallow { domain -init } traced_probes:process transition;
108neverallow * traced_probes:process dyntransition;