tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Define debuggerd class, permissions, and rules.

Browse source 
Define a new class, permissions, and rules for the debuggerd
SELinux MAC checks.

Used by Ib317564e54e07cc21f259e75124b762ad17c6e16 for debuggerd.

Change-Id: I8e120d319512ff207ed22ed87cde4e0432a13dda
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
This commit is contained in:
Stephen Smalley 2014-07-24 15:25:43 -04:00
parent b2eaa28d11
commit ba992496f0
4 changed files with 16 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
access_vectors
View file

@ -915,3 +915,9 @@ class keystore_key
duplicate
clear_uid
}
class debuggerd
{
dump_tombstone
dump_backtrace
}

5
debuggerd.te
View file

@ -9,7 +9,7 @@ allow debuggerd self:capability2 { syslog };
allow debuggerd domain:dir r_dir_perms;
allow debuggerd domain:file r_file_perms;
allow debuggerd domain:lnk_file read;
allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process ptrace;
allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process { ptrace getattr };
security_access_policy(debuggerd)
allow debuggerd system_data_file:dir create_dir_perms;
allow debuggerd system_data_file:dir relabelfrom;
@ -31,3 +31,6 @@ userdebug_or_eng(`
# logd access
read_logd(debuggerd)
# Check SELinux permissions.
selinux_check_access(debuggerd)

3
security_classes
View file

@ -143,4 +143,7 @@ class service_manager # userspace
# Keystore Key
class keystore_key # userspace
# debuggerd service
class debuggerd # userspace
# FLASK

3
system_server.te
View file

@ -127,6 +127,9 @@ binder_call(system_server, appdomain)
binder_call(system_server, dumpstate)
binder_service(system_server)
# Ask debuggerd to dump backtraces for native stacks of interest.
allow system_server { mediaserver sdcardd surfaceflinger inputflinger }:debuggerd dump_backtrace;
# Read /proc/pid files for dumping stack traces of native processes.
r_dir_file(system_server, mediaserver)
r_dir_file(system_server, sdcardd)