tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow shell debugfs read access

Browse source 
Developers should be able to use systrace with user builds.
This requires read access to /sys/kernel/debug/tracing/trace,
otherwise the following error occurs:

  $ atrace
  capturing trace... done
  TRACE:
  error opening /sys/kernel/debug/tracing/trace: Permission denied (13)

with the following SELinux denial:

  <4>[   79.830542] type=1400 audit(11940551.039:8): avc:  denied  { read } for  pid=1156 comm="atrace" name="trace" dev="debugfs" ino=3024 scontext=u:r:shell:s0 tcontext=u:object_r:debugfs:s0 tclass=file

At least on the kernel I've tested this on, debugfs doesn't support
setting SELinux file labels. Grant read access to all of debugfs to
work around this limitation.

Bug: 13904660
Change-Id: Ib58e98972c5012e9b34fec9e0a6094641638cd9a
This commit is contained in:
Nick Kralevich 2014-04-30 11:35:02 -07:00
parent 6838cd54e7
commit 0e06c13784
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
shelldomain.te
View file

@ -25,3 +25,10 @@ allow shelldomain shell_prop:property_service set;
allow shelldomain ctl_dumpstate_prop:property_service set; allow shelldomain ctl_dumpstate_prop:property_service set;
allow shelldomain debug_prop:property_service set; allow shelldomain debug_prop:property_service set;
allow shelldomain powerctl_prop:property_service set; allow shelldomain powerctl_prop:property_service set;
# systrace support - allow atrace to run
# debugfs doesn't support labeling individual files, so we have
# to grant read access to all of /sys/kernel/debug.
# Directory read access and file write access is already granted
# in domain.te.
allow shelldomain debugfs:file r_file_perms;