d22987b4da
Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
42 lines
1.7 KiB
Text
42 lines
1.7 KiB
Text
# debugger interface
|
|
type debuggerd, domain, domain_deprecated;
|
|
type debuggerd_exec, exec_type, file_type;
|
|
|
|
init_daemon_domain(debuggerd)
|
|
typeattribute debuggerd mlstrustedsubject;
|
|
allow debuggerd self:capability { dac_override sys_ptrace chown kill fowner };
|
|
allow debuggerd self:capability2 { syslog };
|
|
allow debuggerd domain:dir r_dir_perms;
|
|
allow debuggerd domain:file r_file_perms;
|
|
allow debuggerd domain:lnk_file read;
|
|
allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process { ptrace getattr };
|
|
security_access_policy(debuggerd)
|
|
allow debuggerd system_data_file:dir create_dir_perms;
|
|
allow debuggerd system_data_file:dir relabelfrom;
|
|
allow debuggerd tombstone_data_file:dir relabelto;
|
|
allow debuggerd tombstone_data_file:dir create_dir_perms;
|
|
allow debuggerd tombstone_data_file:file create_file_perms;
|
|
allow debuggerd shared_relro_file:dir r_dir_perms;
|
|
allow debuggerd shared_relro_file:file r_file_perms;
|
|
allow debuggerd domain:process { sigstop signal };
|
|
allow debuggerd exec_type:file r_file_perms;
|
|
# Access app library
|
|
allow debuggerd system_data_file:file open;
|
|
# Allow debuggerd to redirect a dump_backtrace request to itself.
|
|
# This only happens on 64 bit systems, where all requests go to the 64 bit
|
|
# debuggerd and get redirected to the 32 bit debuggerd if the process is 32 bit.
|
|
allow debuggerd { drmserver mediaserver sdcardd surfaceflinger inputflinger }:debuggerd dump_backtrace;
|
|
|
|
# Connect to system_server via /data/system/ndebugsocket.
|
|
unix_socket_connect(debuggerd, system_ndebug, system_server)
|
|
|
|
userdebug_or_eng(`
|
|
allow debuggerd input_device:dir r_dir_perms;
|
|
allow debuggerd input_device:chr_file rw_file_perms;
|
|
')
|
|
|
|
# logd access
|
|
read_logd(debuggerd)
|
|
|
|
# Check SELinux permissions.
|
|
selinux_check_access(debuggerd)
|