b65824642b
Bug: http://b/135139675
Coverage files are written to /data/misc/trace (governed by the
method_trace_data_file selinux type). Allow all domains to access
(create directories, access files) this directory when native coverage
is enabled (by setting NATIVE_COVERAGE to true) in an userdebug or eng
build.
Also relax neverallow constraints to allow access to
method_trace_data_file for native coverage builds.
Test: Build 32-bit cuttlefish with coverage:
m NATIVE_COVERAGE=true COVERAGE_PATHS="*"
and verify that there are no selinux denials in kernel log and
logcat.
Change-Id: I3fe7c77612854b9de7de7a0ddd5cbf44a2f5c21e
(cherry picked from commit ce9c0c5a5f)
11 lines
329 B
Text
11 lines
329 B
Text
typeattribute recovery_persist coredomain;
|
|
|
|
init_daemon_domain(recovery_persist)
|
|
|
|
# recovery_persist is not allowed to write anywhere other than recovery_data_file
|
|
neverallow recovery_persist {
|
|
file_type
|
|
-recovery_data_file
|
|
userdebug_or_eng(`-coredump_file')
|
|
with_native_coverage(`-method_trace_data_file')
|
|
}:file write;
|