2017-03-23 22:27:32 +01:00
|
|
|
typeattribute logd coredomain;
|
|
|
|
|
2016-07-22 22:13:11 +02:00
|
|
|
init_daemon_domain(logd)
|
2016-10-12 23:58:09 +02:00
|
|
|
|
2020-03-04 09:20:35 +01:00
|
|
|
# Access device logging gating property
|
|
|
|
get_prop(logd, device_logging_prop)
|
|
|
|
|
2016-10-12 23:58:09 +02:00
|
|
|
# logd is not allowed to write anywhere other than /data/misc/logd, and then
|
|
|
|
# only on userdebug or eng builds
|
2016-11-08 00:11:39 +01:00
|
|
|
neverallow logd {
|
|
|
|
file_type
|
|
|
|
-runtime_event_log_tags_file
|
2022-01-12 00:16:12 +01:00
|
|
|
# shell_data_file access is needed to dump bugreports
|
|
|
|
-shell_data_file
|
2016-09-13 18:33:35 +02:00
|
|
|
userdebug_or_eng(`-coredump_file -misc_logd_file')
|
2019-06-14 00:05:15 +02:00
|
|
|
with_native_coverage(`-method_trace_data_file')
|
2016-11-08 00:11:39 +01:00
|
|
|
}:file { create write append };
|
|
|
|
|
|
|
|
# protect the event-log-tags file
|
|
|
|
neverallow {
|
|
|
|
domain
|
|
|
|
-appdomain # covered below
|
|
|
|
-bootstat
|
|
|
|
-dumpstate
|
2016-09-13 18:33:35 +02:00
|
|
|
-init
|
2016-11-08 00:11:39 +01:00
|
|
|
-logd
|
|
|
|
userdebug_or_eng(`-logpersist')
|
|
|
|
-servicemanager
|
|
|
|
-system_server
|
|
|
|
-surfaceflinger
|
|
|
|
-zygote
|
|
|
|
} runtime_event_log_tags_file:file no_rw_file_perms;
|
|
|
|
|
|
|
|
neverallow {
|
|
|
|
appdomain
|
|
|
|
-bluetooth
|
|
|
|
-platform_app
|
|
|
|
-priv_app
|
|
|
|
-radio
|
|
|
|
-shell
|
|
|
|
userdebug_or_eng(`-su')
|
|
|
|
-system_app
|
|
|
|
} runtime_event_log_tags_file:file no_rw_file_perms;
|
2022-01-12 00:16:12 +01:00
|
|
|
|
|
|
|
# Only binder communication between logd and system_server is allowed
|
|
|
|
binder_use(logd)
|
|
|
|
binder_service(logd)
|
|
|
|
binder_call(logd, system_server)
|
|
|
|
|
|
|
|
add_service(logd, logd_service)
|
|
|
|
allow logd logcat_service:service_manager find;
|