tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow dumpstate to call incident CLI

Browse source 
Instead of relying on the regular iteration through the system
services inside dumpstate, dumpstate now uses a dedicated incident CLI
to capture incident report. This patch makes required SELinux changes
to make it happen.

Bug: 137493082
Test: Manually takes a bugreport from command line, power button, and
      BetterBug. Verifies /proto/incident_report.proto exists in the
      zip file, and no unintended avc denial.

Change-Id: I0d93b015b7a9d32db4f3bf10d1c25e5a3ca04e48
This commit is contained in:
Mike Ma 2019-08-21 14:58:13 -07:00
parent 804d99ac76
commit 62dc9488a7
1 changed files with 9 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
private/incident.te
View file

@ -4,10 +4,17 @@ type incident_exec, system_file_type, exec_type, file_type;
# switch to incident domain for incident command
domain_auto_trans(shell, incident_exec, incident)
domain_auto_trans(dumpstate, incident_exec, incident)
# allow incident access to stdout from its parent shell.
allow incident shell:fd use;
# allow incident to communicate with dumpstate, and write incident report to
# /data/data/com.android.shell/files/bugreports/tmp_incident_report
allow incident dumpstate:fd use;
allow incident dumpstate:unix_stream_socket { read write };
allow incident shell_data_file:file write;
# allow incident be able to output data for CTS to fetch.
allow incident devpts:chr_file { read write };
@ -26,5 +33,5 @@ allow incident incident_service:service_manager find;
binder_call(incident, incidentd)
allow incident incidentd:fifo_file write;
# only allow incident being called by shell
neverallow { domain -su -shell -incident } incident_exec:file { execute execute_no_trans };
# only allow incident being called by shell or dumpstate
neverallow { domain -su -shell -incident -dumpstate} incident_exec:file { execute execute_no_trans };