1typeattribute shell coredomain; 2 3# allow shell input injection 4allow shell uhid_device:chr_file rw_file_perms; 5 6# systrace support - allow atrace to run 7allow shell debugfs_tracing_debug:dir r_dir_perms; 8allow shell debugfs_tracing:dir r_dir_perms; 9allow shell debugfs_tracing:file rw_file_perms; 10allow shell debugfs_trace_marker:file getattr; 11allow shell atrace_exec:file rx_file_perms; 12 13userdebug_or_eng(` 14 allow shell debugfs_tracing_debug:file rw_file_perms; 15') 16 17# read config.gz for CTS purposes 18allow shell config_gz:file r_file_perms; 19 20# Run app_process. 21# XXX Transition into its own domain? 22app_domain(shell) 23 24# allow shell to call dumpsys storaged 25binder_call(shell, storaged) 26 27# Perform SELinux access checks, needed for CTS 28selinux_check_access(shell) 29selinux_check_context(shell) 30 31# Control Perfetto traced and obtain traces from it. 32# Needed for Studio and debugging. 33unix_socket_connect(shell, traced_consumer, traced) 34 35# Allow shell binaries to write trace data to Perfetto. Used for testing and 36# cmdline utils. 37allow shell traced:fd use; 38allow shell traced_tmpfs:file { read write getattr map }; 39unix_socket_connect(shell, traced_producer, traced) 40 41domain_auto_trans(shell, vendor_shell_exec, vendor_shell) 42 43# Allow shell binaries to exec the perfetto cmdline util and have that 44# transition into its own domain, so that it behaves consistently to 45# when exec()-d by statsd. 46domain_auto_trans(shell, perfetto_exec, perfetto) 47# Allow to send SIGINT to perfetto when daemonized. 48allow shell perfetto:process signal; 49 50# Allow shell to run adb shell cmd stats commands. Needed for CTS. 51binder_call(shell, statsd); 52 53# Allow shell to read and unlink traces stored in /data/misc/perfetto-traces. 54allow shell perfetto_traces_data_file:dir rw_dir_perms; 55allow shell perfetto_traces_data_file:file r_file_perms; 56 57# Allow shell to run adb shell cmd gpu commands. 58binder_call(shell, gpuservice); 59 60# Allow shell to use atrace HAL 61hal_client_domain(shell, hal_atrace) 62 63# For hostside tests such as CTS listening ports test. 64allow shell proc_net_tcp_udp:file r_file_perms; 65 66# The dl.exec_linker* tests need to execute /system/bin/linker 67# b/124789393 68allow shell system_linker_exec:file rx_file_perms; 69 70# Renderscript host side tests depend on being able to execute 71# /system/bin/bcc (b/126388046) 72allow shell rs_exec:file rx_file_perms; 73 74# Allow shell to start and comminicate with lpdumpd. 75set_prop(shell, lpdumpd_prop); 76binder_call(shell, lpdumpd) 77