platform_system_sepolicy/debuggerd.te

# debugger interface
type debuggerd, domain;
permissive debuggerd;
type debuggerd_exec, exec_type, file_type;

init_daemon_domain(debuggerd)
unconfined_domain(debuggerd)
relabelto_domain(debuggerd)
allow debuggerd tombstone_data_file:dir relabelto;
SE Android policy. 2012-01-04 18:33:27 +01:00			`# debugger interface`
			`type debuggerd, domain;`
Move domains into per-domain permissive mode. Bug: 4070557 Change-Id: I027f76cff6df90e9909711cb81fbd17db95233c1 2013-05-15 06:02:55 +02:00			`permissive debuggerd;`
SE Android policy. 2012-01-04 18:33:27 +01:00			`type debuggerd_exec, exec_type, file_type;`

			`init_daemon_domain(debuggerd)`
Make all domains unconfined. This prevents denials from being generated by the base policy. Over time, these rules will be incrementally tightened to improve security. Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11 2013-05-18 02:11:29 +02:00			`unconfined_domain(debuggerd)`
debuggerd.te: Fix relabelto policy denial In 0c9708b2af4ea345277a47ae7bc1ce890e90d2bc, we removed relabelto from unconfined.te. This broke debuggerd. Fixed. type=1400 audit(1373668537.550:5): avc: denied { relabelto } for pid=44 comm="debuggerd" name="tombstones" dev="mtdblock1" ino=71 scontext=u:r:debuggerd:s0 tcontext=u:object_r:tombstone_data_file:s0 tclass=dir Change-Id: Ic025cbc030d6e776d9d87b1df3240fdc5f0b53d5 2013-07-13 00:38:41 +02:00			`relabelto_domain(debuggerd)`
			`allow debuggerd tombstone_data_file:dir relabelto;`