1# Perfetto user-space tracing daemon (unprivileged) 2 3# type traced is defined under /public (because iorapd rules 4# under public/ need to refer to it). 5type traced_exec, system_file_type, exec_type, file_type; 6type traced_tmpfs, file_type; 7 8# Allow init to exec the daemon. 9init_daemon_domain(traced) 10tmpfs_domain(traced) 11 12# Allow apps in other MLS contexts (for multi-user) to access 13# share memory buffers created by traced. 14typeattribute traced_tmpfs mlstrustedobject; 15 16# Allow traced to start with a lower scheduling class and change 17# class accordingly to what defined in the config provided by 18# the privileged process that controls it. 19allow traced self:global_capability_class_set { sys_nice }; 20 21# Allow to pass a file descriptor for the output trace from "perfetto" (the 22# cmdline client) and other shell binaries to traced and let traced write 23# directly into that (rather than returning the trace contents over the socket). 24allow traced perfetto:fd use; 25allow traced shell:fd use; 26allow traced shell:fifo_file { read write }; 27allow traced perfetto_traces_data_file:file { read write }; 28 29# Allow traceur to pass open file descriptors to traced, so traced can directly 30# write into the output file without doing roundtrips over IPC. 31allow traced traceur_app:fd use; 32allow traced trace_data_file:file { read write }; 33 34# Allow iorapd to pass memfd descriptors to traced, so traced can directly 35# write into the shmem buffer file without doing roundtrips over IPC. 36allow traced iorapd:fd use; 37allow traced iorapd_tmpfs:file { read write }; 38 39# Allow traced to notify Traceur when a trace ends by setting the 40# sys.trace.trace_end_signal property. 41set_prop(traced, system_trace_prop) 42# Allow to lazily start producers. 43set_prop(traced, traced_lazy_prop) 44 45### 46### Neverallow rules 47### 48### traced should NEVER do any of this 49 50# Disallow mapping executable memory (execstack and exec are already disallowed 51# globally in domain.te). 52neverallow traced self:process execmem; 53 54# Block device access. 55neverallow traced dev_type:blk_file { read write }; 56 57# ptrace any other process 58neverallow traced domain:process ptrace; 59 60# Disallows access to /data files, still allowing to write to file descriptors 61# passed through the socket. 62neverallow traced { 63 data_file_type 64 -system_data_file 65 # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a 66 # subsequent neverallow. Currently only getattr and search are allowed. 67 -vendor_data_file 68 -zoneinfo_data_file 69 with_native_coverage(`-method_trace_data_file') 70}:dir *; 71neverallow traced { system_data_file }:dir ~{ getattr search }; 72neverallow traced zoneinfo_data_file:dir ~r_dir_perms; 73neverallow traced { data_file_type -zoneinfo_data_file }:lnk_file *; 74neverallow traced { 75 data_file_type 76 -zoneinfo_data_file 77 -perfetto_traces_data_file 78 -trace_data_file 79 with_native_coverage(`-method_trace_data_file') 80}:file ~write; 81 82# Only init is allowed to enter the traced domain via exec() 83neverallow { domain -init } traced:process transition; 84neverallow * traced:process dyntransition; 85