tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/traceur_app.te

25 lines
782 B
Text
Raw Normal View History

Adding a traceur_app domain to remove it from shell This CL creates a traceur_app domain with userdebug privileges akin to what shell has with regards to being able to find most services on device. Previously, traceur was running as shell which was an unintentional abuse of selinux architecture. Bug: 68126425 Test: Traceur functions outside of shell user privilege Change-Id: Ib5090e7e8225ad201b3ec24b506fe2717101d0f1
2017-12-12 01:19:23 +01:00
typeattribute traceur_app coredomain;
Enable Traceur on user builds. Test: Standard Traceur workflow works successfully with no selinux denials on a user build. Bug: 64762598 Change-Id: I0dfe506d463b63d70c5bda03f8706041ea7ab448
2018-01-09 21:24:47 +01:00
app_domain(traceur_app);
allow traceur_app debugfs_tracing:file rw_file_perms;
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
allow traceur_app debugfs_tracing_debug:dir r_dir_perms;
Enable Traceur on user builds. Test: Standard Traceur workflow works successfully with no selinux denials on a user build. Bug: 64762598 Change-Id: I0dfe506d463b63d70c5bda03f8706041ea7ab448
2018-01-09 21:24:47 +01:00
Adding a traceur_app domain to remove it from shell This CL creates a traceur_app domain with userdebug privileges akin to what shell has with regards to being able to find most services on device. Previously, traceur was running as shell which was an unintentional abuse of selinux architecture. Bug: 68126425 Test: Traceur functions outside of shell user privilege Change-Id: Ib5090e7e8225ad201b3ec24b506fe2717101d0f1
2017-12-12 01:19:23 +01:00
userdebug_or_eng(`
Adding write permissions to traceur Fixing denials that stopped traceur from being able to write to debugfs_tracing. Also cleaning up general find denials for services that traceur doesn't have permission to access. Additionally, labeling /data/local/trace as a trace_data_file in order to give traceur a UX friendly area to write its traces to now that it will no longer be a shell user. It will be write/readable by traceur, and deletable/readable by shell. Test: Traceur functionality is not being blocked by selinux policy Bug: 68126425 Change-Id: I201c82975a31094102e90bc81454d3c2a48fae36
2018-01-16 01:44:04 +01:00
allow traceur_app debugfs_tracing_debug:file rw_file_perms;
Adding a traceur_app domain to remove it from shell This CL creates a traceur_app domain with userdebug privileges akin to what shell has with regards to being able to find most services on device. Previously, traceur was running as shell which was an unintentional abuse of selinux architecture. Bug: 68126425 Test: Traceur functions outside of shell user privilege Change-Id: Ib5090e7e8225ad201b3ec24b506fe2717101d0f1
2017-12-12 01:19:23 +01:00
')
Enable Traceur on user builds. Test: Standard Traceur workflow works successfully with no selinux denials on a user build. Bug: 64762598 Change-Id: I0dfe506d463b63d70c5bda03f8706041ea7ab448
2018-01-09 21:24:47 +01:00
allow traceur_app trace_data_file:file create_file_perms;
Allow Traceur app to remove trace files. Bug: 73660835 Test: With the other commit on this topic, clearing all trace files via the app works properly. Change-Id: I27a4a5a14d9afe817683f1b046a644648a84badc
2018-02-20 23:47:08 +01:00
allow traceur_app trace_data_file:dir rw_dir_perms;
Enable Traceur on user builds. Test: Standard Traceur workflow works successfully with no selinux denials on a user build. Bug: 64762598 Change-Id: I0dfe506d463b63d70c5bda03f8706041ea7ab448
2018-01-09 21:24:47 +01:00
allow traceur_app atrace_exec:file rx_file_perms;
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
Allow the Traceur app to start Perfetto. Bug: 116754732 Test: Started a trace in Traceur using Perfetto successfully. Change-Id: I217857bf1f43f1b7b24454687d1f26b9d5c6c56a
2018-10-20 02:01:24 +02:00
# To exec the perfetto cmdline client and pass it the trace config on
# stdint through a pipe.
allow traceur_app perfetto_exec:file rx_file_perms;
# Allow to access traced's privileged consumer socket.
unix_socket_connect(traceur_app, traced_consumer, traced)
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
dontaudit traceur_app debugfs_tracing_debug:file audit_access;
Move system property rules to private public/property split is landed to selectively export public types to vendors. So rules happening within system should be in private. This introduces private/property.te and moves all allow and neverallow rules from any coredomains to system defiend properties. Bug: 150331497 Test: system/sepolicy/tools/build_policies.sh Change-Id: I0d929024ae9f4ae3830d4bf3d59e999febb22cbe Merged-In: I0d929024ae9f4ae3830d4bf3d59e999febb22cbe (cherry picked from commit 42c7d8966cc5f76c84c001c5af787cbfade736c8)
2020-03-04 09:20:35 +01:00
set_prop(traceur_app, debug_prop)
Reference in a new issue Copy permalink