be5e446791
In an effort to ensure that our development community does not introduce new code without corresponding SELinux changes, Android closely monitors the number of SELinux denials which occur during boot. This monitoring occurs both in treehugger, as well as various dashboards. If SELinux denials are dropped during early boot, this could result in non-determinism for the various SELinux treehugger tests. Introduce /system/bin/auditctl. This tool, model after https://linux.die.net/man/8/auditctl , allows for configuring the throttling rate for the kernel auditing system. Remove any throttling from early boot. This will hopefully reduce treehugger flakiness by making denial generation more predictible during early boot. Reapply the throttling at boot complete, to avoid denial of service attacks against the auditing subsystem. Delete pre-existing unittests for logd / SELinux integration. It's intended that all throttling decisions be made in the kernel, and shouldn't be a concern of logd. Bug: 118815957 Test: Perform an operation which generates lots of SELinux denials, and count how many occur before and after the time period. Change-Id: I6c787dbdd4a28208dc854b543e1727ae92e5eeed
34 lines
879 B
Text
34 lines
879 B
Text
service logd /system/bin/logd
|
|
socket logd stream 0666 logd logd
|
|
socket logdr seqpacket 0666 logd logd
|
|
socket logdw dgram+passcred 0222 logd logd
|
|
file /proc/kmsg r
|
|
file /dev/kmsg w
|
|
user logd
|
|
group logd system package_info readproc
|
|
capabilities SYSLOG AUDIT_CONTROL SETGID
|
|
writepid /dev/cpuset/system-background/tasks
|
|
|
|
service logd-reinit /system/bin/logd --reinit
|
|
oneshot
|
|
disabled
|
|
user logd
|
|
group logd
|
|
writepid /dev/cpuset/system-background/tasks
|
|
|
|
# Limit SELinux denial generation to 5/second
|
|
service logd-auditctl /system/bin/auditctl -r 5
|
|
oneshot
|
|
disabled
|
|
user logd
|
|
group logd
|
|
capabilities AUDIT_CONTROL
|
|
|
|
on fs
|
|
write /dev/event-log-tags "# content owned by logd
|
|
"
|
|
chown logd logd /dev/event-log-tags
|
|
chmod 0644 /dev/event-log-tags
|
|
|
|
on property:sys.boot_completed=1
|
|
start logd-auditctl
|