platform_system_sepolicy/private/logd.te

typeattribute logd coredomain;

init_daemon_domain(logd)

# logd is not allowed to write anywhere other than /data/misc/logd, and then
# only on userdebug or eng builds
# TODO: deal with tmpfs_domain pub/priv split properly
neverallow logd {
  file_type
  -logd_tmpfs
  -runtime_event_log_tags_file
  userdebug_or_eng(`-coredump_file -misc_logd_file')
}:file { create write append };

# protect the event-log-tags file
neverallow {
  domain
  -appdomain # covered below
  -bootstat
  -dumpstate
  -init
  -logd
  userdebug_or_eng(`-logpersist')
  -servicemanager
  -system_server
  -surfaceflinger
  -zygote
} runtime_event_log_tags_file:file no_rw_file_perms;

neverallow {
  appdomain
  -bluetooth
  -platform_app
  -priv_app
  -radio
  -shell
  userdebug_or_eng(`-su')
  -system_app
} runtime_event_log_tags_file:file no_rw_file_perms;