Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 1 | # Perfetto tracing probes, has tracefs access. |
Nick Kralevich | 5e37271 | 2018-09-27 10:21:37 -0700 | [diff] [blame] | 2 | type traced_probes_exec, system_file_type, exec_type, file_type; |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 3 | |
| 4 | # Allow init to exec the daemon. |
| 5 | init_daemon_domain(traced_probes) |
| 6 | |
| 7 | # Write trace data to the Perfetto traced damon. This requires connecting to its |
| 8 | # producer socket and obtaining a (per-process) tmpfs fd. |
| 9 | allow traced_probes traced:fd use; |
| 10 | allow traced_probes traced_tmpfs:file { read write getattr map }; |
| 11 | unix_socket_connect(traced_probes, traced_producer, traced) |
| 12 | |
| 13 | # Allow traced_probes to access tracefs. |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 14 | allow traced_probes debugfs_tracing:dir r_dir_perms; |
| 15 | allow traced_probes debugfs_tracing:file rw_file_perms; |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 16 | allow traced_probes debugfs_trace_marker:file getattr; |
Primiano Tucci | b4b31f9 | 2018-02-09 11:15:22 +0000 | [diff] [blame] | 17 | |
| 18 | # TODO(primiano): temporarily I/O tracing categories are still |
| 19 | # userdebug only until we nail down the blacklist/whitelist. |
| 20 | userdebug_or_eng(` |
| 21 | allow traced_probes debugfs_tracing_debug:file rw_file_perms; |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 22 | ') |
| 23 | |
| 24 | # Allow traced_probes to start with a higher scheduling class and then downgrade |
| 25 | # itself. |
| 26 | allow traced_probes self:global_capability_class_set { sys_nice }; |
| 27 | |
| 28 | # Allow procfs access |
| 29 | r_dir_file(traced_probes, domain) |
| 30 | |
Primiano Tucci | d807d58 | 2018-02-16 13:54:41 +0000 | [diff] [blame] | 31 | # Allow to log to kernel dmesg when starting / stopping ftrace. |
| 32 | allow traced_probes kmsg_device:chr_file write; |
| 33 | |
Florian Mayer | ef6358b | 2018-02-23 16:47:38 +0000 | [diff] [blame] | 34 | # Allow traced_probes to list the system partition. |
| 35 | allow traced_probes system_file:dir { open read }; |
| 36 | |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 37 | # Allow traced_probes to list some of the data partition. |
Benjamin Gordon | 7ed266c | 2018-08-15 13:34:20 -0600 | [diff] [blame] | 38 | allow traced_probes self:global_capability_class_set dac_read_search; |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 39 | |
Florian Mayer | ff14696 | 2018-04-06 12:55:22 +0100 | [diff] [blame] | 40 | allow traced_probes apk_data_file:dir { getattr open read search }; |
| 41 | allow traced_probes dalvikcache_data_file:dir { getattr open read search }; |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 42 | userdebug_or_eng(` |
Florian Mayer | ff14696 | 2018-04-06 12:55:22 +0100 | [diff] [blame] | 43 | allow traced_probes system_data_file:dir { getattr open read search }; |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 44 | ') |
Florian Mayer | ff14696 | 2018-04-06 12:55:22 +0100 | [diff] [blame] | 45 | allow traced_probes system_app_data_file:dir { getattr open read search }; |
| 46 | allow traced_probes backup_data_file:dir { getattr open read search }; |
| 47 | allow traced_probes bootstat_data_file:dir { getattr open read search }; |
| 48 | allow traced_probes update_engine_data_file:dir { getattr open read search }; |
| 49 | allow traced_probes update_engine_log_data_file:dir { getattr open read search }; |
| 50 | allow traced_probes user_profile_data_file:dir { getattr open read search }; |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 51 | |
Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 52 | # Allow traced_probes to run atrace. atrace pokes at system services to enable |
| 53 | # their userspace TRACE macros. |
| 54 | domain_auto_trans(traced_probes, atrace_exec, atrace); |
| 55 | |
Lalit Maganti | d6ae1a5 | 2018-11-16 12:17:24 +0000 | [diff] [blame^] | 56 | # Allow traced_probes to kill atrace on timeout. |
| 57 | allow traced_probes atrace:process sigkill; |
Primiano Tucci | feaf22b | 2018-03-02 19:27:06 +0000 | [diff] [blame] | 58 | |
Primiano Tucci | 51dc7cb | 2018-09-18 08:51:06 +0100 | [diff] [blame] | 59 | # Allow traced_probes to access /proc files for system stats. |
| 60 | # Note: trace data is NOT exposed to anything other than shell and privileged |
| 61 | # system apps that have access to the traced consumer socket. |
| 62 | allow traced_probes { |
| 63 | proc_meminfo |
| 64 | proc_vmstat |
| 65 | proc_stat |
| 66 | }:file r_file_perms; |
| 67 | |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 68 | ### |
| 69 | ### Neverallow rules |
| 70 | ### |
| 71 | ### traced_probes should NEVER do any of this |
| 72 | |
| 73 | # Disallow mapping executable memory (execstack and exec are already disallowed |
| 74 | # globally in domain.te). |
| 75 | neverallow traced_probes self:process execmem; |
| 76 | |
| 77 | # Block device access. |
| 78 | neverallow traced_probes dev_type:blk_file { read write }; |
| 79 | |
| 80 | # ptrace any other app |
| 81 | neverallow traced_probes domain:process ptrace; |
| 82 | |
| 83 | # Disallows access to /data files. |
Primiano Tucci | d807d58 | 2018-02-16 13:54:41 +0000 | [diff] [blame] | 84 | neverallow traced_probes { |
Jeff Vander Stoep | d25ccab | 2018-02-07 16:29:06 -0800 | [diff] [blame] | 85 | data_file_type |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 86 | -apk_data_file |
| 87 | -dalvikcache_data_file |
Jeff Vander Stoep | d25ccab | 2018-02-07 16:29:06 -0800 | [diff] [blame] | 88 | -system_data_file |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 89 | -system_app_data_file |
| 90 | -backup_data_file |
| 91 | -bootstat_data_file |
| 92 | -update_engine_data_file |
| 93 | -update_engine_log_data_file |
| 94 | -user_profile_data_file |
Jeff Vander Stoep | d25ccab | 2018-02-07 16:29:06 -0800 | [diff] [blame] | 95 | # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a |
| 96 | # subsequent neverallow. Currently only getattr and search are allowed. |
| 97 | -vendor_data_file |
| 98 | -zoneinfo_data_file |
| 99 | }:dir *; |
Florian Mayer | 9fcf22b | 2018-03-02 10:52:56 +0000 | [diff] [blame] | 100 | neverallow traced_probes system_data_file:dir ~{ getattr userdebug_or_eng(`open read') search }; |
Primiano Tucci | d807d58 | 2018-02-16 13:54:41 +0000 | [diff] [blame] | 101 | neverallow traced_probes zoneinfo_data_file:dir ~r_dir_perms; |
| 102 | neverallow traced_probes { data_file_type -zoneinfo_data_file }:lnk_file *; |
| 103 | neverallow traced_probes { data_file_type -zoneinfo_data_file }:file *; |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 104 | |
| 105 | # Only init is allowed to enter the traced_probes domain via exec() |
| 106 | neverallow { domain -init } traced_probes:process transition; |
| 107 | neverallow * traced_probes:process dyntransition; |