platform_system_sepolicy/private/heapprofd.te
Ryan Savitski 17caa229a8 Correct hal_configstore label used in profiler rules
hal_configstore_server is what we want to exclude to avoid conflicting
with public/hal_configstore.te neverallows on socket operations. I used
the wrong label in aosp/2419280, but it happened to also cover
hal_configstore_server in the final device sepolicy.

The logical error was caught by CtsSecurityHostTestCases:
  Warning!  Type or attribute hal_configstore used in neverallow
  undefined in policy being checked

Bug: 247858731
Bug: 269707771
Tested: built panther-user
Change-Id: I244e597939478d75f8437e82ff854a5d96c32a87
2023-02-21 16:31:42 +00:00

75 lines
2.3 KiB
Text

# Android heap profiling daemon. go/heapprofd.
type heapprofd_exec, exec_type, file_type, system_file_type;
type heapprofd_tmpfs, file_type;
init_daemon_domain(heapprofd)
tmpfs_domain(heapprofd)
# Allow apps in other MLS contexts (for multi-user) to access
# shared memory buffers created by heapprofd.
typeattribute heapprofd_tmpfs mlstrustedobject;
set_prop(heapprofd, heapprofd_prop);
# Necessary for /proc/[pid]/cmdline access & sending signals.
typeattribute heapprofd mlstrustedsubject;
# Allow sending signals to processes. This excludes SIGKILL, SIGSTOP and
# SIGCHLD, which are controlled by separate permissions.
allow heapprofd self:capability kill;
# When scanning /proc/[pid]/cmdline to find matching processes for by-name
# profiling, only allowlisted domains will be allowed by SELinux. Avoid
# spamming logs with denials for entries that we can not access.
dontaudit heapprofd domain:dir { search open };
# Write trace data to the Perfetto traced daemon. This requires connecting to
# its producer socket and obtaining a (per-process) tmpfs fd.
perfetto_producer(heapprofd)
# When handling profiling for all processes, heapprofd needs to read
# executables/libraries/etc to do stack unwinding.
r_dir_file(heapprofd, nativetest_data_file)
r_dir_file(heapprofd, system_file_type)
r_dir_file(heapprofd, apk_data_file)
r_dir_file(heapprofd, dalvikcache_data_file)
r_dir_file(heapprofd, vendor_file_type)
r_dir_file(heapprofd, shell_test_data_file)
# ART apex files and directory access to the containing /data/misc/apexdata.
r_dir_file(heapprofd, apex_art_data_file)
allow heapprofd apex_module_data_file:dir { getattr search };
# Some dex files are not world-readable.
# We are still constrained by the SELinux rules above.
allow heapprofd self:global_capability_class_set dac_read_search;
# For checking profileability.
allow heapprofd packages_list_file:file r_file_perms;
# Never allow profiling privileged or otherwise incompatible domains.
# Corresponding allow-rule is in private/domain.te.
never_profile_heap(`{
apexd
app_zygote
bpfloader
diced
hal_configstore_server
init
kernel
keystore
llkd
logd
logpersist
recovery
recovery_persist
recovery_refresh
ueventd
vendor_init
vold
webview_zygote
zygote
}')
full_treble_only(`
neverallow heapprofd vendor_file:file { no_w_file_perms no_x_file_perms };
')