platform_system_sepolicy/private/logpersist.te

typeattribute logpersist coredomain;

# android debug log storage in logpersist domains (eng and userdebug only)
userdebug_or_eng(`

  r_dir_file(logpersist, cgroup)

  allow logpersist misc_logd_file:file create_file_perms;
  allow logpersist misc_logd_file:dir rw_dir_perms;

  allow logpersist self:global_capability_class_set sys_nice;
  allow logpersist pstorefs:dir search;
  allow logpersist pstorefs:file r_file_perms;

  control_logd(logpersist)
  unix_socket_connect(logpersist, logdr, logd)
  read_runtime_log_tags(logpersist)

')

# logpersist is allowed to write to /data/misc/log for userdebug and eng builds
neverallow logpersist {
  file_type
  userdebug_or_eng(`-misc_logd_file -coredump_file')
  with_native_coverage(`-method_trace_data_file')
}:file { create write append };
neverallow { domain -init -dumpstate -incidentd userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_rw_file_perms;
neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_w_file_perms;
neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };
Vendor domains must not use Binder On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor apps) are not permitted to use Binder. This commit thus: * groups non-vendor domains using the new "coredomain" attribute, * adds neverallow rules restricting Binder use to coredomain and appdomain only, and * temporarily exempts the domains which are currently violating this rule from this restriction. These domains are grouped using the new "binder_in_vendor_violators" attribute. The attribute is needed because the types corresponding to violators are not exposed to the public policy where the neverallow rules are. Test: mmm system/sepolicy Test: Device boots, no new denials Test: In Chrome, navigate to ip6.me, play a YouTube video Test: YouTube: play a video Test: Netflix: play a movie Test: Google Camera: take a photo, take an HDR+ photo, record video with sound, record slow motion video with sound. Confirm videos play back fine and with sound. Bug: 35870313 Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95 2017-03-23 22:27:32 +01:00			`typeattribute logpersist coredomain;`

logcat: introduce split to logd and logpersist domains - transition to logpersist from init - sort some overlapping negative references - intention is to allow logpersist to be used by vendor userdebug logging Test: gTest liblog-unit-tests, logd-unit-tests & logcat-unit-tests Bug: 30566487 Change-Id: I7806f5a2548cbe0c1f257a0ba2855f2eb69d8e7c 2016-08-10 20:10:02 +02:00			`# android debug log storage in logpersist domains (eng and userdebug only)`
			userdebug_or_eng(`

			`r_dir_file(logpersist, cgroup)`

			`allow logpersist misc_logd_file:file create_file_perms;`
			`allow logpersist misc_logd_file:dir rw_dir_perms;`

sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f 2017-11-09 23:51:26 +01:00			`allow logpersist self:global_capability_class_set sys_nice;`
logcat: introduce split to logd and logpersist domains - transition to logpersist from init - sort some overlapping negative references - intention is to allow logpersist to be used by vendor userdebug logging Test: gTest liblog-unit-tests, logd-unit-tests & logcat-unit-tests Bug: 30566487 Change-Id: I7806f5a2548cbe0c1f257a0ba2855f2eb69d8e7c 2016-08-10 20:10:02 +02:00			`allow logpersist pstorefs:dir search;`
			`allow logpersist pstorefs:file r_file_perms;`

			`control_logd(logpersist)`
			`unix_socket_connect(logpersist, logdr, logd)`
logd: restrict access to /dev/event-log-tags Create an event_log_tags_file label and use it for /dev/event-log-tags. Only trusted system log readers are allowed direct read access to this file, no write access. Untrusted domain requests lack direct access, and are thus checked for credentials via the "plan b" long path socket to the event log tag service. Test: gTest logd-unit-tests, liblog-unit-tests and logcat-unit-tests Bug: 31456426 Bug: 30566487 Change-Id: Ib9b71ca225d4436d764c9bc340ff7b1c9c252a9e 2016-11-08 00:11:39 +01:00			`read_runtime_log_tags(logpersist)`
logcat: introduce split to logd and logpersist domains - transition to logpersist from init - sort some overlapping negative references - intention is to allow logpersist to be used by vendor userdebug logging Test: gTest liblog-unit-tests, logd-unit-tests & logcat-unit-tests Bug: 30566487 Change-Id: I7806f5a2548cbe0c1f257a0ba2855f2eb69d8e7c 2016-08-10 20:10:02 +02:00
			`')`

			`# logpersist is allowed to write to /data/misc/log for userdebug and eng builds`
In native coverage builds, allow all domains to access /data/misc/trace Bug: http://b/135139675 Coverage files are written to /data/misc/trace (governed by the method_trace_data_file selinux type). Allow all domains to access (create directories, access files) this directory when native coverage is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng build. Also relax neverallow constraints to allow access to method_trace_data_file for native coverage builds. Test: Build 32-bit cuttlefish with coverage: m NATIVE_COVERAGE=true COVERAGE_PATHS="*" and verify that there are no selinux denials in kernel log and logcat. Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e 2019-06-14 00:05:15 +02:00			`neverallow logpersist {`
			`file_type`
			userdebug_or_eng(`-misc_logd_file -coredump_file')
			with_native_coverage(`-method_trace_data_file')
			`}:file { create write append };`
Allow incidentd to parse persisted log Allow incidentd to run incident-helper-cmd, a Java program spawn by app_process. Allow incidentd to read /data/misc/logd and its files on userdebug and eng build. Bug: 147924172 Test: Build, flash and verify "adb shell incident -p EXPLICIT 1116" can parse persisted logs. Change-Id: Id0aa4286c304a336741ce8c0949b12ec559c2e16 2020-01-18 04:00:16 +01:00			neverallow { domain -init -dumpstate -incidentd userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_rw_file_perms;
Allow dumpstate to read /data/misc/logd always There is no reason to deny dumpstate from reading /data/misc/logd on user builds. Logpersist is disallowed from running on those builds, so there is no harm in copying this directory. Bug: 136978224 Test: build Change-Id: Ia58bde10e1f45978975597cd2ea1951a784d3b49 2019-07-08 22:17:03 +02:00			neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_w_file_perms;
logd: add getEventTag command and service The event log tag service uses /dev/event-log-tags, pstore and /data/misc/logd/event-log-tags as sticky storage for the invented log tags. Test: gTest liblog-unit-tests, logd-unit-tests & logcat-unit-tests Bug: 31456426 Change-Id: Iacc8f36f4a716d4da8dca78a4a54600ad2a288dd 2016-09-13 18:33:35 +02:00			neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };