7ca04a7e7f
Denials:
SELinux : avc: denied { find } for pid=1279 uid=9999 name=stats scontext=u:r:traced_probes:s0 tcontext=u:object_r:stats_service:s0 tclass=service_manager permissive=0
traced_probes: type=1400 audit(0.0:11): avc: denied { call } for scontext=u:r:traced_probes:s0 tcontext=u:r:statsd:s0 tclass=binder permissive=1
traced_probes: type=1400 audit(0.0:12): avc: denied { transfer } for scontext=u:r:traced_probes:s0 tcontext=u:r:statsd:s0 tclass=binder permissive=1
binder:1076_7: type=1400 audit(0.0:13): avc: denied { call } for scontext=u:r:statsd:s0 tcontext=u:r:traced_probes:s0 tclass=binder permissive=1
See go/ww-atom-subscriber-api
Testing steps:
Patch ag/21985690
Run:
$ adb push test/configs/statsd.cfg /data/misc/perfetto-configs/statsd.cfg
$ adb shell perfetto --txt -c /data/misc/perfetto-configs/statsd.cfg -o /data/misc/perfetto-traces/statsd.pb
$ adb pull /data/misc/perfetto-traces/statsd.pb statsd.pb
$ out/linux_clang_debug/traceconv text statsd.pb
Check logcat for denials.
Test: See above
Bug: 268661096
Change-Id: I58045b55ca8a4aa6f00774cc2d72d7b10a232922
60 lines
1.3 KiB
Text
60 lines
1.3 KiB
Text
type stats, domain;
|
|
typeattribute stats coredomain;
|
|
type stats_exec, system_file_type, exec_type, file_type;
|
|
|
|
# switch to stats domain for stats command
|
|
domain_auto_trans(shell, stats_exec, stats)
|
|
|
|
# allow stats access to stdout from its parent shell.
|
|
allow stats shell:fd use;
|
|
|
|
# allow stats to communicate use, read and write over the adb
|
|
# connection.
|
|
allow stats adbd:fd use;
|
|
allow stats adbd:unix_stream_socket { read write };
|
|
|
|
# allow adbd to reap stats
|
|
allow stats adbd:process { sigchld };
|
|
|
|
# Allow the stats command to talk to the statsd over the binder, and get
|
|
# back the stats report data from a ParcelFileDescriptor.
|
|
binder_use(stats)
|
|
allow stats stats_service:service_manager find;
|
|
binder_call(stats, statsd)
|
|
allow stats statsd:fifo_file write;
|
|
|
|
# Only statsd can publish the binder service.
|
|
add_service(statsd, stats_service)
|
|
|
|
# Allow pipes from (and only from) stats.
|
|
allow statsd stats:fd use;
|
|
allow statsd stats:fifo_file write;
|
|
|
|
# Allow statsd to call back to stats with status updates.
|
|
binder_call(statsd, stats)
|
|
|
|
###
|
|
### neverallow rules
|
|
###
|
|
|
|
neverallow {
|
|
domain
|
|
-dumpstate
|
|
-gmscore_app
|
|
-gpuservice
|
|
-incidentd
|
|
-keystore
|
|
-mediametrics
|
|
-mediaserver
|
|
-platform_app
|
|
-priv_app
|
|
-rkpdapp
|
|
-shell
|
|
-stats
|
|
-statsd
|
|
-surfaceflinger
|
|
-system_app
|
|
-system_server
|
|
-traceur_app
|
|
-traced_probes
|
|
} stats_service:service_manager find;
|