blob: ef5a3960f83646afc71574475dac7dd0a6015deb [file] [log] [blame]
Primiano Tuccic80f9e02017-12-21 03:51:15 +01001# Perfetto tracing probes, has tracefs access.
Primiano Tuccic80f9e02017-12-21 03:51:15 +01002type traced_probes_exec, exec_type, file_type;
3
4# Allow init to exec the daemon.
5init_daemon_domain(traced_probes)
6
7# Write trace data to the Perfetto traced damon. This requires connecting to its
8# producer socket and obtaining a (per-process) tmpfs fd.
9allow traced_probes traced:fd use;
10allow traced_probes traced_tmpfs:file { read write getattr map };
11unix_socket_connect(traced_probes, traced_producer, traced)
12
13# Allow traced_probes to access tracefs.
Primiano Tuccic80f9e02017-12-21 03:51:15 +010014allow traced_probes debugfs_tracing:dir r_dir_perms;
15allow traced_probes debugfs_tracing:file rw_file_perms;
Primiano Tuccic80f9e02017-12-21 03:51:15 +010016allow traced_probes debugfs_trace_marker:file getattr;
Primiano Tuccib4b31f92018-02-09 11:15:22 +000017
18# TODO(primiano): temporarily I/O tracing categories are still
19# userdebug only until we nail down the blacklist/whitelist.
20userdebug_or_eng(`
21allow traced_probes debugfs_tracing_debug:file rw_file_perms;
Primiano Tuccic80f9e02017-12-21 03:51:15 +010022')
23
24# Allow traced_probes to start with a higher scheduling class and then downgrade
25# itself.
26allow traced_probes self:global_capability_class_set { sys_nice };
27
28# Allow procfs access
29r_dir_file(traced_probes, domain)
30
Primiano Tuccid807d582018-02-16 13:54:41 +000031# Allow to log to kernel dmesg when starting / stopping ftrace.
32allow traced_probes kmsg_device:chr_file write;
33
Florian Mayeref6358b2018-02-23 16:47:38 +000034# Allow traced_probes to list the system partition.
35allow traced_probes system_file:dir { open read };
36
Florian Mayer9fcf22b2018-03-02 10:52:56 +000037# Allow traced_probes to list some of the data partition.
Benjamin Gordon7ed266c2018-08-15 13:34:20 -060038allow traced_probes self:global_capability_class_set dac_read_search;
Florian Mayer9fcf22b2018-03-02 10:52:56 +000039
Florian Mayerff146962018-04-06 12:55:22 +010040allow traced_probes apk_data_file:dir { getattr open read search };
41allow traced_probes dalvikcache_data_file:dir { getattr open read search };
Florian Mayer9fcf22b2018-03-02 10:52:56 +000042userdebug_or_eng(`
Florian Mayerff146962018-04-06 12:55:22 +010043allow traced_probes system_data_file:dir { getattr open read search };
Florian Mayer9fcf22b2018-03-02 10:52:56 +000044')
Florian Mayerff146962018-04-06 12:55:22 +010045allow traced_probes system_app_data_file:dir { getattr open read search };
46allow traced_probes backup_data_file:dir { getattr open read search };
47allow traced_probes bootstat_data_file:dir { getattr open read search };
48allow traced_probes update_engine_data_file:dir { getattr open read search };
49allow traced_probes update_engine_log_data_file:dir { getattr open read search };
50allow traced_probes user_profile_data_file:dir { getattr open read search };
Florian Mayer9fcf22b2018-03-02 10:52:56 +000051
Primiano Tuccifeaf22b2018-03-02 19:27:06 +000052# Allow traced_probes to run atrace. atrace pokes at system services to enable
53# their userspace TRACE macros.
54domain_auto_trans(traced_probes, atrace_exec, atrace);
55
56# This is needed for: path="/system/bin/linker64"
57# scontext=u:r:atrace:s0 tcontext=u:r:traced_probes:s0 tclass=fd
58allow atrace traced_probes:fd use;
59
Primiano Tuccic80f9e02017-12-21 03:51:15 +010060###
61### Neverallow rules
62###
63### traced_probes should NEVER do any of this
64
65# Disallow mapping executable memory (execstack and exec are already disallowed
66# globally in domain.te).
67neverallow traced_probes self:process execmem;
68
69# Block device access.
70neverallow traced_probes dev_type:blk_file { read write };
71
72# ptrace any other app
73neverallow traced_probes domain:process ptrace;
74
75# Disallows access to /data files.
Primiano Tuccid807d582018-02-16 13:54:41 +000076neverallow traced_probes {
Jeff Vander Stoepd25ccab2018-02-07 16:29:06 -080077 data_file_type
Florian Mayer9fcf22b2018-03-02 10:52:56 +000078 -apk_data_file
79 -dalvikcache_data_file
Jeff Vander Stoepd25ccab2018-02-07 16:29:06 -080080 -system_data_file
Florian Mayer9fcf22b2018-03-02 10:52:56 +000081 -system_app_data_file
82 -backup_data_file
83 -bootstat_data_file
84 -update_engine_data_file
85 -update_engine_log_data_file
86 -user_profile_data_file
Jeff Vander Stoepd25ccab2018-02-07 16:29:06 -080087 # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a
88 # subsequent neverallow. Currently only getattr and search are allowed.
89 -vendor_data_file
90 -zoneinfo_data_file
91}:dir *;
Florian Mayer9fcf22b2018-03-02 10:52:56 +000092neverallow traced_probes system_data_file:dir ~{ getattr userdebug_or_eng(`open read') search };
Primiano Tuccid807d582018-02-16 13:54:41 +000093neverallow traced_probes zoneinfo_data_file:dir ~r_dir_perms;
94neverallow traced_probes { data_file_type -zoneinfo_data_file }:lnk_file *;
95neverallow traced_probes { data_file_type -zoneinfo_data_file }:file *;
Primiano Tuccic80f9e02017-12-21 03:51:15 +010096
97# Only init is allowed to enter the traced_probes domain via exec()
98neverallow { domain -init } traced_probes:process transition;
99neverallow * traced_probes:process dyntransition;