Lines Matching refs:shell
1 typeattribute shell coredomain, mlstrustedsubject;
3 # allow shell input injection
4 allow shell uhid_device:chr_file rw_file_perms;
7 allow shell debugfs_tracing_debug:dir r_dir_perms;
8 allow shell debugfs_tracing:dir r_dir_perms;
9 allow shell debugfs_tracing:file rw_file_perms;
10 allow shell debugfs_trace_marker:file getattr;
11 allow shell atrace_exec:file rx_file_perms;
14 allow shell debugfs_tracing_debug:file rw_file_perms;
18 allow shell config_gz:file r_file_perms;
22 app_domain(shell)
24 # allow shell to call dumpsys storaged
25 binder_call(shell, storaged)
28 selinux_check_access(shell)
29 selinux_check_context(shell)
33 unix_socket_connect(shell, traced_consumer, traced)
35 # Allow shell binaries to write trace data to Perfetto. Used for testing and
37 perfetto_producer(shell)
39 domain_auto_trans(shell, vendor_shell_exec, vendor_shell)
41 # Allow shell binaries to exec the perfetto cmdline util and have that
44 domain_auto_trans(shell, perfetto_exec, perfetto)
46 allow shell perfetto:process signal;
48 # Allow shell to run adb shell cmd stats commands. Needed for CTS.
49 binder_call(shell, statsd);
51 # Allow shell to read and unlink traces stored in /data/misc/a11ytraces.
53 allow shell accessibility_trace_data_file:dir rw_dir_perms;
54 allow shell accessibility_trace_data_file:file { r_file_perms unlink };
57 # Allow shell to read and unlink traces stored in /data/misc/perfetto-traces.
58 allow shell perfetto_traces_data_file:dir rw_dir_perms;
59 allow shell perfetto_traces_data_file:file { r_file_perms unlink };
61 allow shell perfetto_traces_bugreport_data_file:dir rw_dir_perms;
62 allow shell perfetto_traces_bugreport_data_file:file { r_file_perms unlink };
64 # Allow shell to create/remove configs stored in /data/misc/perfetto-configs.
65 allow shell perfetto_configs_data_file:dir rw_dir_perms;
66 allow shell perfetto_configs_data_file:file create_file_perms;
68 # Allow shell to run adb shell cmd gpu commands.
69 binder_call(shell, gpuservice);
71 # Allow shell to use atrace HAL
72 hal_client_domain(shell, hal_atrace)
75 allow shell proc_net_tcp_udp:file r_file_perms;
79 allow shell system_linker_exec:file rx_file_perms;
83 allow shell rs_exec:file rx_file_perms;
87 allow shell dex2oat_exec:file rx_file_perms;
89 # Allow shell to start and comminicate with lpdumpd.
90 set_prop(shell, lpdumpd_prop);
91 binder_call(shell, lpdumpd)
93 # Allow shell to set and read value of properties used for CTS tests of
95 set_prop(shell, userspace_reboot_test_prop)
97 # Allow shell to set this property used for rollback tests
98 set_prop(shell, rollback_test_prop)
100 # Allow shell to get encryption policy of /data/local/tmp/, for CTS
101 allowxperm shell shell_data_file:dir ioctl {
106 # Allow shell to execute simpleperf without a domain transition.
107 allow shell simpleperf_exec:file rx_file_perms;
109 # Allow shell to execute profcollectctl without a domain transition.
110 allow shell profcollectd_exec:file rx_file_perms;
112 # Allow shell to call perf_event_open for profiling other shell processes, but
114 allow shell self:perf_event { open read write kernel };
115 neverallow shell self:perf_event ~{ open read write kernel };
117 # Allow shell to read /apex/apex-info-list.xml and the vendor apexes
118 allow shell apex_info_file:file r_file_perms;
119 allow shell vendor_apex_file:file r_file_perms;
120 allow shell vendor_apex_file:dir r_dir_perms;
123 set_prop(shell, shell_prop)
124 set_prop(shell, ctl_bugreport_prop)
125 set_prop(shell, ctl_dumpstate_prop)
126 set_prop(shell, dumpstate_prop)
127 set_prop(shell, exported_dumpstate_prop)
128 set_prop(shell, debug_prop)
129 set_prop(shell, perf_drop_caches_prop)
130 set_prop(shell, powerctl_prop)
131 set_prop(shell, log_tag_prop)
132 set_prop(shell, wifi_log_prop)
133 # Allow shell to start/stop traced via the persist.traced.enable
135 set_prop(shell, traced_enabled_prop)
137 userdebug_or_eng(`set_prop(shell, log_prop)')
139 userdebug_or_eng(`set_prop(shell, logpersistd_logging_prop)')
140 # Allow shell to start/stop heapprofd via the persist.heapprofd.enable
142 set_prop(shell, heapprofd_enabled_prop)
143 # Allow shell to start/stop traced_perf via the persist.traced_perf.enable
145 set_prop(shell, traced_perf_enabled_prop)
146 # Allow shell to start/stop gsid via ctl.start|stop|restart gsid.
147 set_prop(shell, ctl_gsid_prop)
148 set_prop(shell, ctl_snapuserd_prop)
149 # Allow shell to enable Dynamic System Update
150 set_prop(shell, dynamic_system_prop)
151 # Allow shell to mock an OTA using persist.pm.mock-upgrade
152 set_prop(shell, mock_ota_prop)
155 get_prop(shell, serialno_prop)
157 # Allow shell to read the vendor security patch level for CTS
158 get_prop(shell, vendor_security_patch_level_prop)
161 get_prop(shell, device_logging_prop)
164 get_prop(shell, bootloader_boot_reason_prop)
165 get_prop(shell, last_boot_reason_prop)
166 get_prop(shell, system_boot_reason_prop)
169 get_prop(shell, init_perf_lsm_hooks_prop)
171 # Allow shell to read boot image timestamps and fingerprints.
172 get_prop(shell, build_bootimage_prop)
174 userdebug_or_eng(`set_prop(shell, persist_debug_prop)')
178 allow shell profcollectd:binder call;
181 # Allow shell to read the keystore key contexts files. Used by native tests to test label lookup.
182 allow shell keystore2_key_contexts_file:file r_file_perms;
184 # Allow shell to access the keystore2_key namespace shell_key. Mainly used for native tests.
185 allow shell shell_key:keystore2_key { delete rebind use get_info update };
187 # Allow shell to write db.log.detailed, db.log.slow_query_threshold*
188 set_prop(shell, sqlite_log_prop)
190 # Allow shell to write MTE properties even on user builds.
191 set_prop(shell, arm64_memtag_prop)
193 # Allow shell to read the dm-verity props on user builds.
194 get_prop(shell, verity_status_prop)
196 # Allow shell to read Virtual A/B related properties
197 get_prop(shell, virtual_ab_prop)
200 neverallow { domain -shell -init } perf_drop_caches_prop:property_service set;
201 neverallow { domain -shell -init -dumpstate } perf_drop_caches_prop:file read;
204 read_fstab(shell)
206 # Allow shell read access to /apex/apex-info-list.xml for CTS.
207 allow shell apex_info_file:file r_file_perms;