platform_system_sepolicy/public/traced.te

type traced, domain, coredomain, mlstrustedsubject;
type traced_tmpfs, file_type;

# system/sepolicy/public is for vendor-facing type and attribute definitions.
# DO NOT ADD allow, neverallow, or dontaudit statements here.
# Instead, add such policy rules to system/sepolicy/private/*.te.
Allow iorapd to access perfetto This requires moving the type declaration of perfetto traced to public, because iorapd needs to refer to it. Denials without this CL: https://pastebin.com/raw/sxHMeLEU Bug: 72170747 Test: 1. runcon u:r:iorapd:s0 iorap.cmd.perfetto \ -v --output-proto /data/misc/iorapd/test 2. Check that no selinux denials other than avc: denied { entrypoint } for path="/system/bin/iorap.cmd.perfetto" dev="sda6" ino=21 scontext=u:r:iorapd:s0 tcontext=u:object_r:system_file:s0 tclass=file permissive=1 show up (this is a side-effect of runcon). Change-Id: Iacd1ab201fe9fb2a6302dbd528f42f709cbca054 2019-01-23 21:42:16 +01:00			`type traced, domain, coredomain, mlstrustedsubject;`
traced: move traced_tmpfs to public policy Allow the perfetto_producer macro to be used in device-specific policy. Bug: 185379881 Test: TH Change-Id: I6932ff91a3ed095b5edce4076bdfd8607e925c6e 2021-04-14 22:18:41 +02:00			`type traced_tmpfs, file_type;`
Allow iorapd to access perfetto This requires moving the type declaration of perfetto traced to public, because iorapd needs to refer to it. Denials without this CL: https://pastebin.com/raw/sxHMeLEU Bug: 72170747 Test: 1. runcon u:r:iorapd:s0 iorap.cmd.perfetto \ -v --output-proto /data/misc/iorapd/test 2. Check that no selinux denials other than avc: denied { entrypoint } for path="/system/bin/iorap.cmd.perfetto" dev="sda6" ino=21 scontext=u:r:iorapd:s0 tcontext=u:object_r:system_file:s0 tclass=file permissive=1 show up (this is a side-effect of runcon). Change-Id: Iacd1ab201fe9fb2a6302dbd528f42f709cbca054 2019-01-23 21:42:16 +01:00
Add "DO NOT ADD statements" comments to public For visibility Bug: 232023812 Test: N/A Change-Id: I0bc6dc568210b81ba1f52acb18afd4bcc454ea1c 2024-03-28 02:37:28 +01:00			`# system/sepolicy/public is for vendor-facing type and attribute definitions.`
			`# DO NOT ADD allow, neverallow, or dontaudit statements here.`
			`# Instead, add such policy rules to system/sepolicy/private/*.te.`