1# android user-space log manager 2type logd, domain, mlstrustedsubject; 3type logd_exec, exec_type, file_type; 4 5# Read access to pseudo filesystems. 6r_dir_file(logd, cgroup) 7r_dir_file(logd, proc_kmsg) 8r_dir_file(logd, proc_meminfo) 9r_dir_file(logd, proc_net) 10 11allow logd self:global_capability_class_set { setuid setgid setpcap sys_nice audit_control }; 12allow logd self:global_capability2_class_set syslog; 13allow logd self:netlink_audit_socket { create_socket_perms_no_ioctl nlmsg_write }; 14allow logd kernel:system syslog_read; 15allow logd kmsg_device:chr_file w_file_perms; 16allow logd system_data_file:{ file lnk_file } r_file_perms; 17allow logd pstorefs:dir search; 18allow logd pstorefs:file r_file_perms; 19userdebug_or_eng(` 20 # Access to /data/misc/logd/event-log-tags 21 allow logd misc_logd_file:dir r_dir_perms; 22 allow logd misc_logd_file:file rw_file_perms; 23') 24allow logd runtime_event_log_tags_file:file rw_file_perms; 25 26# Access device logging gating property 27get_prop(logd, device_logging_prop) 28 29r_dir_file(logd, domain) 30 31allow logd kernel:system syslog_mod; 32 33control_logd(logd) 34read_runtime_log_tags(logd) 35 36allow runtime_event_log_tags_file tmpfs:filesystem associate; 37# Typically harmlessly blindly trying to access via liblog 38# event tag mapping while in the untrusted_app domain. 39# Access for that domain is controlled and gated via the 40# event log tag service (albeit at a performance penalty, 41# expected to be locally cached). 42dontaudit domain runtime_event_log_tags_file:file { open read }; 43 44### 45### Neverallow rules 46### 47### logd should NEVER do any of this 48 49# Block device access. 50neverallow logd dev_type:blk_file { read write }; 51 52# ptrace any other app 53neverallow logd domain:process ptrace; 54 55# ... and nobody may ptrace me (except on userdebug or eng builds) 56neverallow { domain userdebug_or_eng(`-crash_dump') } logd:process ptrace; 57 58# Write to /system. 59neverallow logd system_file:dir_file_class_set write; 60 61# Write to files in /data/data or system files on /data 62neverallow logd { app_data_file system_data_file }:dir_file_class_set write; 63 64# Only init is allowed to enter the logd domain via exec() 65neverallow { domain -init } logd:process transition; 66neverallow * logd:process dyntransition; 67 68# protect the event-log-tags file 69neverallow { 70 domain 71 -init 72 -logd 73} runtime_event_log_tags_file:file no_w_file_perms; 74