tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow snapuserd to write log files to /data/misc

Browse source 
snapuserd logs are important when OTA failures happen. To make debugging
easier, allow snapuserd to persist logs in /data/misc/snapuserd_logs ,
and capture these logs in bugreport.

Bug: 280127810
Change-Id: I49e30fd97ea143e7b9c799b0c746150217d5cbe0
This commit is contained in:
Kelvin Zhang 2023-04-28 17:25:49 -07:00
parent a296496996
commit dbe230a193
5 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/compat/33.0/33.0.ignore.cil
View file

@ -60,6 +60,7 @@
rkpdapp
servicemanager_prop
shutdown_checkpoints_system_data_file
snapuserd_log_data_file
stats_config_data_file
sysfs_fs_fuse_features
system_net_netd_service

1
private/file_contexts
View file

@ -664,6 +664,7 @@
/data/misc/vold(/.*)? u:object_r:vold_data_file:s0
/data/misc/update_engine(/.*)? u:object_r:update_engine_data_file:s0
/data/misc/update_engine_log(/.*)? u:object_r:update_engine_log_data_file:s0
/data/misc/snapuserd_log(/.*)? u:object_r:snapuserd_log_data_file:s0
/data/system/dropbox(/.*)? u:object_r:dropbox_data_file:s0
/data/system/heapdump(/.*)? u:object_r:heapdump_data_file:s0
/data/misc/trace(/.*)? u:object_r:method_trace_data_file:s0

7
private/snapuserd.te
View file

@ -57,6 +57,13 @@ allow snapuserd metadata_file:dir search;
allow snapuserd ota_metadata_file:dir rw_dir_perms;
allow snapuserd ota_metadata_file:file create_file_perms;
# write to /data/misc/snapuserd_log
allow snapuserd snapuserd_log_data_file:dir create_dir_perms;
allow snapuserd snapuserd_log_data_file:file create_file_perms;
# Read /proc/stat to determine boot time
allow snapuserd proc_stat:file r_file_perms;
# This capability allows snapuserd to circumvent memlock rlimits while using
# io_uring. An Alternative would be to up the memlock rlimit for the snapuserd service.
allow snapuserd self:capability ipc_lock;

3
public/dumpstate.te
View file

@ -259,6 +259,9 @@ allow dumpstate recovery_data_file:file r_file_perms;
# Access /data/misc/update_engine & /data/misc/update_engine_log
allow dumpstate { update_engine_data_file update_engine_log_data_file }:dir r_dir_perms;
allow dumpstate { update_engine_data_file update_engine_log_data_file }:file r_file_perms;
# Access /data/misc/snapuserd_log
allow dumpstate snapuserd_log_data_file:dir r_dir_perms;
allow dumpstate snapuserd_log_data_file:file r_file_perms;
# Access /data/misc/profiles/{cur,ref}/
userdebug_or_eng(`

1
public/file.te
View file

@ -460,6 +460,7 @@ type vold_data_file, file_type, data_file_type, core_data_file_type;
type tee_data_file, file_type, data_file_type;
type update_engine_data_file, file_type, data_file_type, core_data_file_type;
type update_engine_log_data_file, file_type, data_file_type, core_data_file_type;
type snapuserd_log_data_file, file_type, data_file_type, core_data_file_type;
# /data/misc/trace for method traces on userdebug / eng builds
type method_trace_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
type gsi_data_file, file_type, data_file_type, core_data_file_type;