tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow incidentd to parse persisted log

Browse source 
Allow incidentd to run incident-helper-cmd, a Java program spawn by
app_process.
Allow incidentd to read /data/misc/logd and its files on userdebug
and eng build.

Bug: 147924172
Test: Build, flash and verify "adb shell incident -p EXPLICIT 1116"
      can parse persisted logs.

Change-Id: Id0aa4286c304a336741ce8c0949b12ec559c2e16
This commit is contained in:
Mike Ma 2020-01-17 19:00:16 -08:00
parent 7eca7d1e9b
commit 08f494d200
2 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
private/incidentd.te
View file

@ -128,10 +128,18 @@ unix_socket_connect(incidentd, tombstoned_intercept, tombstoned)
# Run a shell. # Run a shell.
allow incidentd shell_exec:file rx_file_perms; allow incidentd shell_exec:file rx_file_perms;
# For running am, incident-helper-cmd and similar framework commands.
# Run /system/bin/app_process.
allow incidentd zygote_exec:file { rx_file_perms };
# logd access - work to be done is a PII safe log (possibly an event log?) # logd access - work to be done is a PII safe log (possibly an event log?)
userdebug_or_eng(`read_logd(incidentd)') userdebug_or_eng(`read_logd(incidentd)')
# TODO control_logd(incidentd) # TODO control_logd(incidentd)
# Access /data/misc/logd
allow incidentd misc_logd_file:dir r_dir_perms;
allow incidentd misc_logd_file:file r_file_perms;
# Allow incidentd to find these standard groups of services. # Allow incidentd to find these standard groups of services.
# Others can be whitelisted individually. # Others can be whitelisted individually.
allow incidentd { allow incidentd {

2
private/logpersist.te
View file

@ -24,6 +24,6 @@ neverallow logpersist {
userdebug_or_eng(`-misc_logd_file -coredump_file') userdebug_or_eng(`-misc_logd_file -coredump_file')
with_native_coverage(`-method_trace_data_file') with_native_coverage(`-method_trace_data_file')
}:file { create write append }; }:file { create write append };
neverallow { domain -init -dumpstate userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_rw_file_perms; neverallow { domain -init -dumpstate -incidentd userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_rw_file_perms;
neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_w_file_perms; neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_w_file_perms;
neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write }; neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };