1# dumpstate 2type dumpstate, domain, mlstrustedsubject; 3type dumpstate_exec, system_file_type, exec_type, file_type; 4 5net_domain(dumpstate) 6binder_use(dumpstate) 7wakelock_use(dumpstate) 8 9# Allow setting process priority, protect from OOM killer, and dropping 10# privileges by switching UID / GID 11allow dumpstate self:global_capability_class_set { setuid setgid sys_resource }; 12 13# Allow dumpstate to scan through /proc/pid for all processes 14r_dir_file(dumpstate, domain) 15 16allow dumpstate self:global_capability_class_set { 17 # Send signals to processes 18 kill 19 # Run iptables 20 net_raw 21 net_admin 22}; 23 24# Allow executing files on system, such as: 25# /system/bin/toolbox 26# /system/bin/logcat 27# /system/bin/dumpsys 28allow dumpstate system_file:file execute_no_trans; 29not_full_treble(`allow dumpstate vendor_file:file execute_no_trans;') 30allow dumpstate toolbox_exec:file rx_file_perms; 31 32# hidl searches for files in /system/lib(64)/hw/ 33allow dumpstate system_file:dir r_dir_perms; 34 35# Create and write into /data/anr/ 36allow dumpstate self:global_capability_class_set { dac_override dac_read_search chown fowner fsetid }; 37allow dumpstate anr_data_file:dir rw_dir_perms; 38allow dumpstate anr_data_file:file create_file_perms; 39 40# Allow reading /data/system/uiderrors.txt 41# TODO: scope this down. 42allow dumpstate system_data_file:file r_file_perms; 43 44# Allow dumpstate to append into privileged apps private files. 45allow dumpstate privapp_data_file:file append; 46 47# Read dmesg 48allow dumpstate self:global_capability2_class_set syslog; 49allow dumpstate kernel:system syslog_read; 50 51# Read /sys/fs/pstore/console-ramoops 52allow dumpstate pstorefs:dir r_dir_perms; 53allow dumpstate pstorefs:file r_file_perms; 54 55# Get process attributes 56allow dumpstate domain:process getattr; 57 58# Signal java processes to dump their stack 59allow dumpstate { appdomain system_server zygote }:process signal; 60 61# Signal native processes to dump their stack. 62allow dumpstate { 63 # This list comes from native_processes_to_dump in dumputils/dump_utils.c 64 audioserver 65 cameraserver 66 drmserver 67 inputflinger 68 mediadrmserver 69 mediaextractor 70 mediametrics 71 mediaserver 72 mediaswcodec 73 sdcardd 74 surfaceflinger 75 vold 76 77 # This list comes from hal_interfaces_to_dump in dumputils/dump_utils.c 78 hal_audio_server 79 hal_bluetooth_server 80 hal_camera_server 81 hal_codec2_server 82 hal_drm_server 83 hal_face_server 84 hal_graphics_allocator_server 85 hal_graphics_composer_server 86 hal_health_server 87 hal_omx_server 88 hal_power_server 89 hal_power_stats_server 90 hal_sensors_server 91 hal_thermal_server 92 hal_vr_server 93}:process signal; 94 95# Connect to tombstoned to intercept dumps. 96unix_socket_connect(dumpstate, tombstoned_intercept, tombstoned) 97 98# Access to /sys 99allow dumpstate sysfs_type:dir r_dir_perms; 100 101allow dumpstate { 102 sysfs_devices_block 103 sysfs_dm 104 sysfs_loop 105 sysfs_usb 106 sysfs_zram 107}:file r_file_perms; 108 109# Other random bits of data we want to collect 110allow dumpstate debugfs:file r_file_perms; 111auditallow dumpstate debugfs:file r_file_perms; 112 113allow dumpstate debugfs_mmc:file r_file_perms; 114 115# df for 116allow dumpstate { 117 block_device 118 cache_file 119 metadata_file 120 rootfs 121 selinuxfs 122 storage_file 123 tmpfs 124}:dir { search getattr }; 125allow dumpstate fuse_device:chr_file getattr; 126allow dumpstate { dm_device cache_block_device }:blk_file getattr; 127allow dumpstate { cache_file rootfs }:lnk_file { getattr read }; 128 129# Read /dev/cpuctl and /dev/cpuset 130r_dir_file(dumpstate, cgroup) 131 132# Allow dumpstate to make binder calls to any binder service 133binder_call(dumpstate, binderservicedomain) 134binder_call(dumpstate, { appdomain netd wificond }) 135 136hal_client_domain(dumpstate, hal_dumpstate) 137hal_client_domain(dumpstate, hal_wifi) 138hal_client_domain(dumpstate, hal_graphics_allocator) 139# Vibrate the device after we are done collecting the bugreport 140hal_client_domain(dumpstate, hal_vibrator) 141 142# Reading /proc/PID/maps of other processes 143allow dumpstate self:global_capability_class_set sys_ptrace; 144 145# Allow the bugreport service to create a file in 146# /data/data/com.android.shell/files/bugreports/bugreport 147allow dumpstate shell_data_file:dir create_dir_perms; 148allow dumpstate shell_data_file:file create_file_perms; 149 150# Run a shell. 151allow dumpstate shell_exec:file rx_file_perms; 152 153# For running am and similar framework commands. 154# Run /system/bin/app_process. 155allow dumpstate zygote_exec:file rx_file_perms; 156 157# For Bluetooth 158allow dumpstate bluetooth_data_file:dir search; 159allow dumpstate bluetooth_logs_data_file:dir r_dir_perms; 160allow dumpstate bluetooth_logs_data_file:file r_file_perms; 161 162# Dumpstate calls screencap, which grabs a screenshot. Needs gpu access 163allow dumpstate gpu_device:chr_file rw_file_perms; 164 165# logd access 166read_logd(dumpstate) 167control_logd(dumpstate) 168read_runtime_log_tags(dumpstate) 169 170# Read files in /proc 171allow dumpstate { 172 proc_buddyinfo 173 proc_cmdline 174 proc_meminfo 175 proc_modules 176 proc_net_type 177 proc_pipe_conf 178 proc_pagetypeinfo 179 proc_qtaguid_ctrl 180 proc_qtaguid_stat 181 proc_slabinfo 182 proc_version 183 proc_vmallocinfo 184 proc_vmstat 185}:file r_file_perms; 186 187# Read network state info files. 188allow dumpstate net_data_file:dir search; 189allow dumpstate net_data_file:file r_file_perms; 190 191# List sockets via ss. 192allow dumpstate self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read }; 193 194# Access /data/tombstones. 195allow dumpstate tombstone_data_file:dir r_dir_perms; 196allow dumpstate tombstone_data_file:file r_file_perms; 197 198# Access /cache/recovery 199allow dumpstate cache_recovery_file:dir r_dir_perms; 200allow dumpstate cache_recovery_file:file r_file_perms; 201 202# Access /data/misc/recovery 203allow dumpstate recovery_data_file:dir r_dir_perms; 204allow dumpstate recovery_data_file:file r_file_perms; 205 206#Access /data/misc/update_engine_log 207allow dumpstate update_engine_log_data_file:dir r_dir_perms; 208allow dumpstate update_engine_log_data_file:file r_file_perms; 209 210# Access /data/misc/profiles/{cur,ref}/ 211userdebug_or_eng(` 212 allow dumpstate user_profile_data_file:dir r_dir_perms; 213 allow dumpstate user_profile_data_file:file r_file_perms; 214') 215 216# Access /data/misc/logd 217userdebug_or_eng(` 218 allow dumpstate misc_logd_file:dir r_dir_perms; 219 allow dumpstate misc_logd_file:file r_file_perms; 220') 221 222allow dumpstate app_fuse_file:dir r_dir_perms; 223allow dumpstate overlayfs_file:dir r_dir_perms; 224 225allow dumpstate { 226 service_manager_type 227 -apex_service 228 -dumpstate_service 229 -gatekeeper_service 230 -iorapd_service 231 -virtual_touchpad_service 232 -vold_service 233 -vr_hwc_service 234}:service_manager find; 235# suppress denials for services dumpstate should not be accessing. 236dontaudit dumpstate { 237 apex_service 238 dumpstate_service 239 gatekeeper_service 240 iorapd_service 241 virtual_touchpad_service 242 vold_service 243 vr_hwc_service 244}:service_manager find; 245 246# Most of these are neverallowed. 247dontaudit dumpstate hwservice_manager_type:hwservice_manager find; 248 249allow dumpstate servicemanager:service_manager list; 250allow dumpstate hwservicemanager:hwservice_manager list; 251 252allow dumpstate devpts:chr_file rw_file_perms; 253 254# Set properties. 255# dumpstate_prop is used to share state with the Shell app. 256set_prop(dumpstate, dumpstate_prop) 257set_prop(dumpstate, exported_dumpstate_prop) 258# dumpstate_options_prop is used to pass extra command-line args. 259set_prop(dumpstate, dumpstate_options_prop) 260 261# Read any system properties 262get_prop(dumpstate, property_type) 263 264# Access to /data/media. 265# This should be removed if sdcardfs is modified to alter the secontext for its 266# accesses to the underlying FS. 267allow dumpstate media_rw_data_file:dir getattr; 268allow dumpstate proc_interrupts:file r_file_perms; 269allow dumpstate proc_zoneinfo:file r_file_perms; 270 271# Create a service for talking back to system_server 272add_service(dumpstate, dumpstate_service) 273 274# use /dev/ion for screen capture 275allow dumpstate ion_device:chr_file r_file_perms; 276 277# Allow dumpstate to run top 278allow dumpstate proc_stat:file r_file_perms; 279 280# Allow dumpstate to talk to installd over binder 281binder_call(dumpstate, installd); 282 283# Allow dumpstate to run ip xfrm policy 284allow dumpstate self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_read }; 285 286# Allow dumpstate to run iotop 287allow dumpstate self:netlink_socket create_socket_perms_no_ioctl; 288# newer kernels (e.g. 4.4) have a new class for sockets 289allow dumpstate self:netlink_generic_socket create_socket_perms_no_ioctl; 290 291# Allow dumpstate to run ss 292allow dumpstate { domain pdx_channel_socket_type pdx_endpoint_socket_type }:socket_class_set getattr; 293 294# For when dumpstate runs df 295dontaudit dumpstate mnt_vendor_file:dir search; 296dontaudit dumpstate apex_mnt_dir:dir getattr; 297 298# Allow dumpstate to talk to bufferhubd over binder 299binder_call(dumpstate, bufferhubd); 300 301# Allow dumpstate to talk to mediaswcodec over binder 302binder_call(dumpstate, mediaswcodec); 303 304# Allow dumpstate to kill vendor dumpstate service by init 305set_prop(dumpstate, ctl_dumpstate_prop) 306 307### 308### neverallow rules 309### 310 311# dumpstate has capability sys_ptrace, but should only use that capability for 312# accessing sensitive /proc/PID files, never for using ptrace attach. 313neverallow dumpstate *:process ptrace; 314 315# only system_server, dumpstate, traceur_app and shell can find the dumpstate service 316neverallow { 317 domain 318 -system_server 319 -shell 320 -traceur_app 321 -dumpstate 322} dumpstate_service:service_manager find; 323