f821b5a797
Allow the shell user to see the dmesg output. This data is already available via "adb bugreport", but isn't easy to access. Bug: 10020939 Change-Id: I9d4bbbd41cb02b707cdfee79f826a39c1ec2f177
37 lines
1.4 KiB
Text
37 lines
1.4 KiB
Text
# Rules for all shell domains (e.g. console service and adb shell).
|
|
|
|
# Access /data/local/tmp.
|
|
allow shelldomain shell_data_file:dir create_dir_perms;
|
|
allow shelldomain shell_data_file:file create_file_perms;
|
|
allow shelldomain shell_data_file:file rx_file_perms;
|
|
|
|
# adb bugreport
|
|
unix_socket_connect(shelldomain, dumpstate, dumpstate)
|
|
|
|
allow shelldomain rootfs:dir r_dir_perms;
|
|
allow shelldomain devpts:chr_file rw_file_perms;
|
|
allow shelldomain tty_device:chr_file rw_file_perms;
|
|
allow shelldomain console_device:chr_file rw_file_perms;
|
|
allow shelldomain input_device:chr_file rw_file_perms;
|
|
allow shelldomain system_file:file x_file_perms;
|
|
allow shelldomain shell_exec:file rx_file_perms;
|
|
allow shelldomain zygote_exec:file rx_file_perms;
|
|
|
|
r_dir_file(shelldomain, apk_data_file)
|
|
|
|
# Set properties.
|
|
unix_socket_connect(shelldomain, property, init)
|
|
allow shelldomain shell_prop:property_service set;
|
|
allow shelldomain ctl_dumpstate_prop:property_service set;
|
|
allow shelldomain debug_prop:property_service set;
|
|
allow shelldomain powerctl_prop:property_service set;
|
|
|
|
# systrace support - allow atrace to run
|
|
# debugfs doesn't support labeling individual files, so we have
|
|
# to grant read access to all of /sys/kernel/debug.
|
|
# Directory read access and file write access is already granted
|
|
# in domain.te.
|
|
allow shelldomain debugfs:file r_file_perms;
|
|
|
|
# allow shell to run dmesg
|
|
allow shelldomain kernel:system syslog_read;
|