tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Allow to signal perfetto from shell."

Browse source
This commit is contained in:
Treehugger Robot 2018-12-17 22:00:45 +00:00 committed by Gerrit Code Review
commit b209cb9670
4 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/perfetto.te
View file

@ -3,7 +3,6 @@
# This command line client accesses the privileged socket of the traced # This command line client accesses the privileged socket of the traced
# daemon. # daemon.
type perfetto, domain, coredomain;
type perfetto_exec, system_file_type, exec_type, file_type; type perfetto_exec, system_file_type, exec_type, file_type;
tmpfs_domain(perfetto); tmpfs_domain(perfetto);

2
private/shell.te
View file

@ -44,6 +44,8 @@ domain_auto_trans(shell, vendor_shell_exec, vendor_shell)
# transition into its own domain, so that it behaves consistently to # transition into its own domain, so that it behaves consistently to
# when exec()-d by statsd. # when exec()-d by statsd.
domain_auto_trans(shell, perfetto_exec, perfetto) domain_auto_trans(shell, perfetto_exec, perfetto)
# Allow to send SIGINT to perfetto when daemonized.
allow shell perfetto:process signal;
# Allow shell to run adb shell cmd stats commands. Needed for CTS. # Allow shell to run adb shell cmd stats commands. Needed for CTS.
binder_call(shell, statsd); binder_call(shell, statsd);

4
public/app.te
View file

@ -432,7 +432,9 @@ neverallow { appdomain -shell } { domain -appdomain }:file no_rw_file_perms;
# sigchld allowed for parent death notification. # sigchld allowed for parent death notification.
# signull allowed for kill(pid, 0) existence test. # signull allowed for kill(pid, 0) existence test.
# All others prohibited. # All others prohibited.
neverallow appdomain { domain -appdomain }:process # -perfetto is to allow shell (which is an appdomain) to kill perfetto
# (see private/shell.te).
neverallow appdomain { domain -appdomain -perfetto }:process
{ sigkill sigstop signal }; { sigkill sigstop signal };
# Write to rootfs. # Write to rootfs.

1
public/perfetto.te Normal file
View file

@ -0,0 +1 @@
type perfetto, domain, coredomain;