platform_system_sepolicy/debuggerd.te

# debugger interface
type debuggerd, domain;
type debuggerd_exec, exec_type, file_type;

init_daemon_domain(debuggerd)
unconfined_domain(debuggerd)
relabelto_domain(debuggerd)
allow debuggerd tombstone_data_file:dir relabelto;

# Connect to system_server via /data/system/ndebugsocket.
unix_socket_connect(debuggerd, system_ndebug, system_server)
SE Android policy. 2012-01-04 18:33:27 +01:00			`# debugger interface`
			`type debuggerd, domain;`
			`type debuggerd_exec, exec_type, file_type;`

			`init_daemon_domain(debuggerd)`
Make all domains unconfined. This prevents denials from being generated by the base policy. Over time, these rules will be incrementally tightened to improve security. Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11 2013-05-18 02:11:29 +02:00			`unconfined_domain(debuggerd)`
debuggerd.te: Fix relabelto policy denial In 0c9708b2af4ea345277a47ae7bc1ce890e90d2bc, we removed relabelto from unconfined.te. This broke debuggerd. Fixed. type=1400 audit(1373668537.550:5): avc: denied { relabelto } for pid=44 comm="debuggerd" name="tombstones" dev="mtdblock1" ino=71 scontext=u:r:debuggerd:s0 tcontext=u:object_r:tombstone_data_file:s0 tclass=dir Change-Id: Ic025cbc030d6e776d9d87b1df3240fdc5f0b53d5 2013-07-13 00:38:41 +02:00			`relabelto_domain(debuggerd)`
			`allow debuggerd tombstone_data_file:dir relabelto;`
Label and allow access to /data/system/ndebugsocket. Otherwise it defaults to the label of /data/system and cannot be distinguished from any other socket in that directory. Also adds allow rule required for pre-existing wpa_socket transition to function without unconfined_domain. Change-Id: I57179aa18786bd56d247f397347e546cca978e41 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-09-27 16:24:49 +02:00
			`# Connect to system_server via /data/system/ndebugsocket.`
			`unix_socket_connect(debuggerd, system_ndebug, system_server)`