| Dan Cashman | 8058248 | 2017-12-06 09:20:27 -0800 | [diff] [blame] | 1 | # perfprofd - perf profile collection daemon |
| 2 | type perfprofd, domain; |
| 3 | type perfprofd_exec, exec_type, file_type; |
| 4 | |
| 5 | userdebug_or_eng(` |
| 6 | |
| 7 | typeattribute perfprofd coredomain; |
| 8 | typeattribute perfprofd mlstrustedsubject; |
| 9 | |
| 10 | # perfprofd needs to control CPU hot-plug in order to avoid kernel |
| 11 | # perfevents problems in cases where CPU goes on/off during measurement; |
| 12 | # this means read access to /sys/devices/system/cpu/possible |
| 13 | # and read/write access to /sys/devices/system/cpu/cpu*/online |
| 14 | allow perfprofd sysfs_devices_system_cpu:file rw_file_perms; |
| 15 | |
| 16 | # perfprofd checks for the existence of and then invokes simpleperf; |
| 17 | # simpleperf retains perfprofd domain after exec |
| 18 | allow perfprofd system_file:file rx_file_perms; |
| 19 | |
| 20 | # perfprofd reads a config file from /data/data/com.google.android.gms/files |
| 21 | allow perfprofd app_data_file:file r_file_perms; |
| 22 | allow perfprofd app_data_file:dir search; |
| 23 | allow perfprofd self:capability { dac_override }; |
| 24 | |
| 25 | # perfprofd opens a file for writing in /data/misc/perfprofd |
| 26 | allow perfprofd perfprofd_data_file:file create_file_perms; |
| 27 | allow perfprofd perfprofd_data_file:dir rw_dir_perms; |
| 28 | |
| 29 | # perfprofd uses the system log |
| 30 | read_logd(perfprofd); |
| 31 | write_logd(perfprofd); |
| 32 | |
| 33 | # perfprofd inspects /sys/power/wake_unlock |
| 34 | wakelock_use(perfprofd); |
| 35 | |
| 36 | # simpleperf uses ioctl() to turn on kernel perf events measurements |
| 37 | allow perfprofd self:capability sys_admin; |
| 38 | |
| 39 | # simpleperf needs to examine /proc to collect task/thread info |
| 40 | r_dir_file(perfprofd, domain) |
| 41 | |
| 42 | # simpleperf needs to access /proc/<pid>/exec |
| 43 | allow perfprofd self:capability { sys_resource sys_ptrace }; |
| 44 | neverallow perfprofd domain:process ptrace; |
| 45 | |
| 46 | # simpleperf needs open/read any file that turns up in a profile |
| 47 | # to see whether it has a build ID |
| 48 | allow perfprofd exec_type:file r_file_perms; |
| 49 | |
| 50 | # simpleperf examines debugfs on startup to collect tracepoint event types |
| 51 | allow perfprofd debugfs_tracing:file r_file_perms; |
| 52 | |
| 53 | # simpleperf is going to execute "sleep" |
| 54 | allow perfprofd toolbox_exec:file rx_file_perms; |
| 55 | |
| 56 | # needed for simpleperf on some kernels |
| 57 | allow perfprofd self:capability ipc_lock; |
| 58 | |
| 59 | ') |