37f0662413
Similar to aosp/961857, but enables the logging of atrace events from
the camera HAL (primarily HIDL interactions, but also a couple of ION
events).
Keeping it confined to userdebug_or_eng. Longer-term planning belongs on
b/78136428.
Not adding fwk_camera_hwservice, as it is a HIDL interface to
cameraserver (which is already covered above).
Plus slight reorganization of existing atrace.te contents, and donaudits
to reduce logspam from denials (including pre-existing ones that were
hitting the rate limiter).
Specific denials addressed (listing HALs, finding camera HAL, notifying it):
05-15 18:07:19.684 618 618 E SELinux : avc: denied { list } for scontext=u:r:atrace:s0 tcontext=u:r:hwservicemanager:s0 tclass=hwservice_manager permissive=1
05-15 18:07:19.701 618 618 E SELinux : avc: denied { find } for interface=android.hardware.camera.provider::ICameraProvider sid=u:r:atrace:s0 pid=10137 scontext=u:r:atrace:s0 tcontext=u:object_r:hal_camera_hwservice:s0 tclass=hwservice_manager permissive=1
05-15 18:07:19.698 10137 10137 I atrace : type=1400 audit(0.0:273): avc: denied { call } for scontext=u:r:atrace:s0 tcontext=u:r:hal_camera_default:s0 tclass=binder permissive=1
Bug: 130543265
Tested: flashed blueline-userdebug, took a trace with perfetto, confirmed HIDL atrace slices present in camera hal trace.
Merged-In: I0f8ce989355603e41d6c05c3de07e7dd615555eb
Change-Id: I0f8ce989355603e41d6c05c3de07e7dd615555eb
(cherry picked from commit 19459a3802)
78 lines
2.6 KiB
Text
78 lines
2.6 KiB
Text
# Domain for atrace process.
|
|
# It is spawned either by traced_probes or by init for the boottrace service.
|
|
|
|
type atrace, domain, coredomain;
|
|
type atrace_exec, exec_type, file_type, system_file_type;
|
|
|
|
# boottrace services uses /data/misc/boottrace/categories
|
|
allow atrace boottrace_data_file:dir search;
|
|
allow atrace boottrace_data_file:file r_file_perms;
|
|
|
|
# Allow atrace to access tracefs.
|
|
allow atrace debugfs_tracing:dir r_dir_perms;
|
|
allow atrace debugfs_tracing:file rw_file_perms;
|
|
allow atrace debugfs_trace_marker:file getattr;
|
|
|
|
# Allow atrace to write data when a pipe is used for stdout/stderr
|
|
# This is used by Perfetto to capture the output on error in atrace.
|
|
allow atrace traced_probes:fd use;
|
|
allow atrace traced_probes:fifo_file write;
|
|
|
|
# atrace sets debug.atrace.* properties
|
|
set_prop(atrace, debug_prop)
|
|
|
|
# atrace pokes all the binder-enabled processes at startup with a
|
|
# SYSPROPS_TRANSACTION, to tell them to reload the debug.atrace.* properties.
|
|
|
|
# Allow discovery of binder services.
|
|
allow atrace {
|
|
service_manager_type
|
|
-apex_service
|
|
-incident_service
|
|
-iorapd_service
|
|
-netd_service
|
|
-dnsresolver_service
|
|
-stats_service
|
|
-dumpstate_service
|
|
-installd_service
|
|
-vold_service
|
|
-lpdump_service
|
|
}:service_manager { find };
|
|
allow atrace servicemanager:service_manager list;
|
|
|
|
# Allow notifying the processes hosting specific binder services that
|
|
# trace-related system properties have changed.
|
|
binder_use(atrace)
|
|
allow atrace healthd:binder call;
|
|
allow atrace surfaceflinger:binder call;
|
|
allow atrace system_server:binder call;
|
|
allow atrace cameraserver:binder call;
|
|
|
|
# Similarly, on debug builds, allow specific HALs to be notified that
|
|
# trace-related system properties have changed.
|
|
userdebug_or_eng(`
|
|
# List HAL interfaces.
|
|
allow atrace hwservicemanager:hwservice_manager list;
|
|
# Notify the camera HAL.
|
|
hal_client_domain(atrace, hal_camera)
|
|
')
|
|
|
|
# Remove logspam from notification attempts to non-whitelisted services.
|
|
dontaudit atrace hwservice_manager_type:hwservice_manager find;
|
|
dontaudit atrace service_manager_type:service_manager find;
|
|
dontaudit atrace domain:binder call;
|
|
|
|
# atrace can call atrace HAL
|
|
hal_client_domain(atrace, hal_atrace)
|
|
|
|
get_prop(atrace, hwservicemanager_prop)
|
|
|
|
userdebug_or_eng(`
|
|
# atrace is generally invoked as a standalone binary from shell or perf
|
|
# daemons like Perfetto traced_probes. However, in userdebug builds, there is
|
|
# a further option to run atrace as an init daemon for boot tracing.
|
|
init_daemon_domain(atrace)
|
|
|
|
allow atrace debugfs_tracing_debug:dir r_dir_perms;
|
|
allow atrace debugfs_tracing_debug:file rw_file_perms;
|
|
')
|