Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 1 | # Domain for atrace process. |
| 2 | # It is spawned either by traced_probes or by init for the boottrace service. |
Alex Klyubin | 357c161 | 2017-02-07 10:54:20 -0800 | [diff] [blame] | 3 | |
Nick Kralevich | 5e37271 | 2018-09-27 10:21:37 -0700 | [diff] [blame] | 4 | type atrace_exec, exec_type, file_type, system_file_type; |
Alex Klyubin | 357c161 | 2017-02-07 10:54:20 -0800 | [diff] [blame] | 5 | |
Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 6 | # boottrace services uses /data/misc/boottrace/categories |
| 7 | allow atrace boottrace_data_file:dir search; |
| 8 | allow atrace boottrace_data_file:file r_file_perms; |
Alex Klyubin | 357c161 | 2017-02-07 10:54:20 -0800 | [diff] [blame] | 9 | |
Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 10 | # Allow atrace to access tracefs. |
| 11 | allow atrace debugfs_tracing:dir r_dir_perms; |
| 12 | allow atrace debugfs_tracing:file rw_file_perms; |
| 13 | allow atrace debugfs_trace_marker:file getattr; |
| 14 | |
Lalit Maganti | d6ae1a5 | 2018-11-16 12:17:24 +0000 | [diff] [blame] | 15 | # Allow atrace to write data when a pipe is used for stdout/stderr |
| 16 | # This is used by Perfetto to capture the output on error in atrace. |
| 17 | allow atrace traced_probes:fd use; |
| 18 | allow atrace traced_probes:fifo_file write; |
| 19 | |
Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 20 | # atrace sets debug.atrace.* properties |
| 21 | set_prop(atrace, debug_prop) |
| 22 | |
| 23 | # atrace pokes all the binder-enabled processes at startup with a |
| 24 | # SYSPROPS_TRANSACTION, to tell them to reload the debug.atrace.* properties. |
| 25 | |
Ryan Savitski | 19459a3 | 2019-05-15 16:45:04 +0100 | [diff] [blame] | 26 | # Allow discovery of binder services. |
Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 27 | allow atrace { |
| 28 | service_manager_type |
Martijn Coenen | ac097ac | 2018-08-17 09:35:42 +0200 | [diff] [blame] | 29 | -apex_service |
Luke Huang | 524f25e | 2019-02-25 20:12:15 +0800 | [diff] [blame] | 30 | -dnsresolver_service |
Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 31 | -dumpstate_service |
Carmen Jackson | a60d7f2 | 2021-06-23 16:53:45 -0700 | [diff] [blame] | 32 | -incident_service |
Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 33 | -installd_service |
Carmen Jackson | a60d7f2 | 2021-06-23 16:53:45 -0700 | [diff] [blame] | 34 | -iorapd_service |
Yifan Hong | 18ade86 | 2019-03-14 15:45:03 -0700 | [diff] [blame] | 35 | -lpdump_service |
paulhu | 70b0a77 | 2021-12-09 11:49:23 +0800 | [diff] [blame^] | 36 | -mdns_service |
Carmen Jackson | a60d7f2 | 2021-06-23 16:53:45 -0700 | [diff] [blame] | 37 | -netd_service |
| 38 | -stats_service |
| 39 | -tracingproxy_service |
| 40 | -vold_service |
Steven Moreland | a30464c | 2020-01-21 10:18:57 -0800 | [diff] [blame] | 41 | -default_android_service |
Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 42 | }:service_manager { find }; |
| 43 | allow atrace servicemanager:service_manager list; |
| 44 | |
Ryan Savitski | 19459a3 | 2019-05-15 16:45:04 +0100 | [diff] [blame] | 45 | # Allow notifying the processes hosting specific binder services that |
| 46 | # trace-related system properties have changed. |
| 47 | binder_use(atrace) |
Ryan Savitski | 19459a3 | 2019-05-15 16:45:04 +0100 | [diff] [blame] | 48 | allow atrace surfaceflinger:binder call; |
| 49 | allow atrace system_server:binder call; |
| 50 | allow atrace cameraserver:binder call; |
| 51 | |
| 52 | # Similarly, on debug builds, allow specific HALs to be notified that |
| 53 | # trace-related system properties have changed. |
| 54 | userdebug_or_eng(` |
| 55 | # List HAL interfaces. |
| 56 | allow atrace hwservicemanager:hwservice_manager list; |
| 57 | # Notify the camera HAL. |
| 58 | hal_client_domain(atrace, hal_camera) |
Harpreet "Eli" Sangha | 1b62e7f | 2019-06-17 12:25:05 +0900 | [diff] [blame] | 59 | hal_client_domain(atrace, hal_vibrator) |
Ryan Savitski | 19459a3 | 2019-05-15 16:45:04 +0100 | [diff] [blame] | 60 | ') |
| 61 | |
Jeff Sharkey | a0e7a6d | 2020-07-31 12:28:11 -0600 | [diff] [blame] | 62 | # Remove logspam from notification attempts to non-allowlisted services. |
Ryan Savitski | 19459a3 | 2019-05-15 16:45:04 +0100 | [diff] [blame] | 63 | dontaudit atrace hwservice_manager_type:hwservice_manager find; |
| 64 | dontaudit atrace service_manager_type:service_manager find; |
| 65 | dontaudit atrace domain:binder call; |
| 66 | |
| 67 | # atrace can call atrace HAL |
| 68 | hal_client_domain(atrace, hal_atrace) |
| 69 | |
| 70 | get_prop(atrace, hwservicemanager_prop) |
| 71 | |
Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 72 | userdebug_or_eng(` |
| 73 | # atrace is generally invoked as a standalone binary from shell or perf |
| 74 | # daemons like Perfetto traced_probes. However, in userdebug builds, there is |
| 75 | # a further option to run atrace as an init daemon for boot tracing. |
Yasuhiro Matsuda | 3d32817 | 2015-06-24 15:24:17 +0900 | [diff] [blame] | 76 | init_daemon_domain(atrace) |
Alex Klyubin | 357c161 | 2017-02-07 10:54:20 -0800 | [diff] [blame] | 77 | |
Carmen Jackson | 2c8ca45 | 2018-01-30 18:14:45 -0800 | [diff] [blame] | 78 | allow atrace debugfs_tracing_debug:dir r_dir_perms; |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 79 | allow atrace debugfs_tracing_debug:file rw_file_perms; |
Nick Kralevich | b56e6ef | 2016-12-09 20:14:31 -0800 | [diff] [blame] | 80 | ') |