1# dumpstate 2type dumpstate, domain, mlstrustedsubject; 3type dumpstate_exec, exec_type, file_type; 4 5net_domain(dumpstate) 6binder_use(dumpstate) 7wakelock_use(dumpstate) 8 9# Allow setting process priority, protect from OOM killer, and dropping 10# privileges by switching UID / GID 11allow dumpstate self:capability { setuid setgid sys_resource }; 12 13# Allow dumpstate to scan through /proc/pid for all processes 14r_dir_file(dumpstate, domain) 15 16allow dumpstate self:capability { 17 # Send signals to processes 18 kill 19 # Run iptables 20 net_raw 21 net_admin 22}; 23 24# Allow executing files on system, such as: 25# /system/bin/toolbox 26# /system/bin/logcat 27# /system/bin/dumpsys 28allow dumpstate system_file:file execute_no_trans; 29not_full_treble(`allow dumpstate vendor_file:file execute_no_trans;') 30allow dumpstate toolbox_exec:file rx_file_perms; 31 32# hidl searches for files in /system/lib(64)/hw/ 33allow dumpstate system_file:dir r_dir_perms; 34 35# Create and write into /data/anr/ 36allow dumpstate self:capability { dac_override chown fowner fsetid }; 37allow dumpstate anr_data_file:dir rw_dir_perms; 38allow dumpstate anr_data_file:file create_file_perms; 39 40# Allow reading /data/system/uiderrors.txt 41# TODO: scope this down. 42allow dumpstate system_data_file:file r_file_perms; 43 44# Read dmesg 45allow dumpstate self:capability2 syslog; 46allow dumpstate kernel:system syslog_read; 47 48# Read /sys/fs/pstore/console-ramoops 49allow dumpstate pstorefs:dir r_dir_perms; 50allow dumpstate pstorefs:file r_file_perms; 51 52# Get process attributes 53allow dumpstate domain:process getattr; 54 55# Signal java processes to dump their stack 56allow dumpstate { appdomain system_server }:process signal; 57 58# Signal native processes to dump their stack. 59allow dumpstate { 60 # This list comes from native_processes_to_dump in dumpstate/utils.c 61 audioserver 62 cameraserver 63 drmserver 64 inputflinger 65 mediadrmserver 66 mediaextractor 67 mediaserver 68 sdcardd 69 surfaceflinger 70 71 # This list comes from hal_interfaces_to_dump in dumpstate/utils.c 72 hal_audio_server 73 hal_bluetooth_server 74 hal_camera_server 75 hal_graphics_composer_server 76 hal_sensors_server 77 hal_vr_server 78 mediacodec # TODO(b/36375899): hal_omx_server 79}:process signal; 80 81# Connect to tombstoned to intercept dumps. 82unix_socket_connect(dumpstate, tombstoned_intercept, tombstoned) 83 84# TODO: added to match above sysfs rule. Remove me? 85allow dumpstate sysfs_usb:file w_file_perms; 86 87# Other random bits of data we want to collect 88allow dumpstate qtaguid_proc:file r_file_perms; 89allow dumpstate debugfs:file r_file_perms; 90 91# df for 92allow dumpstate { 93 block_device 94 cache_file 95 rootfs 96 selinuxfs 97 storage_file 98 tmpfs 99}:dir { search getattr }; 100allow dumpstate fuse_device:chr_file getattr; 101allow dumpstate { dm_device cache_block_device }:blk_file getattr; 102allow dumpstate { cache_file rootfs }:lnk_file { getattr read }; 103 104# Read /dev/cpuctl and /dev/cpuset 105r_dir_file(dumpstate, cgroup) 106 107# Allow dumpstate to make binder calls to any binder service 108binder_call(dumpstate, binderservicedomain) 109binder_call(dumpstate, { appdomain netd wificond }) 110 111hal_client_domain(dumpstate, hal_dumpstate) 112hal_client_domain(dumpstate, hal_graphics_allocator) 113# Vibrate the device after we are done collecting the bugreport 114hal_client_domain(dumpstate, hal_vibrator) 115# For passthrough mode: 116allow dumpstate sysfs_vibrator:file { rw_file_perms getattr }; 117 118# Reading /proc/PID/maps of other processes 119allow dumpstate self:capability sys_ptrace; 120 121# Allow the bugreport service to create a file in 122# /data/data/com.android.shell/files/bugreports/bugreport 123allow dumpstate shell_data_file:dir create_dir_perms; 124allow dumpstate shell_data_file:file create_file_perms; 125 126# Run a shell. 127allow dumpstate shell_exec:file rx_file_perms; 128 129# For running am and similar framework commands. 130# Run /system/bin/app_process. 131allow dumpstate zygote_exec:file rx_file_perms; 132# Dalvik Compiler JIT. 133allow dumpstate ashmem_device:chr_file execute; 134allow dumpstate self:process execmem; 135# For art. 136allow dumpstate dalvikcache_data_file:dir { search getattr }; 137allow dumpstate dalvikcache_data_file:file { r_file_perms execute }; 138allow dumpstate dalvikcache_data_file:lnk_file r_file_perms; 139 140# For Bluetooth 141allow dumpstate bluetooth_data_file:dir search; 142allow dumpstate bluetooth_logs_data_file:dir r_dir_perms; 143allow dumpstate bluetooth_logs_data_file:file r_file_perms; 144 145# Dumpstate calls screencap, which grabs a screenshot. Needs gpu access 146allow dumpstate gpu_device:chr_file rw_file_perms; 147 148# logd access 149read_logd(dumpstate) 150control_logd(dumpstate) 151read_runtime_log_tags(dumpstate) 152 153# Read files in /proc 154allow dumpstate proc_meminfo:file r_file_perms; 155allow dumpstate proc_net:file r_file_perms; 156r_dir_file(dumpstate, proc) 157 158# Read network state info files. 159allow dumpstate net_data_file:dir search; 160allow dumpstate net_data_file:file r_file_perms; 161 162# List sockets via ss. 163allow dumpstate self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read }; 164 165# Access /data/tombstones. 166allow dumpstate tombstone_data_file:dir r_dir_perms; 167allow dumpstate tombstone_data_file:file r_file_perms; 168 169# Access /cache/recovery 170allow dumpstate cache_recovery_file:dir r_dir_perms; 171allow dumpstate cache_recovery_file:file r_file_perms; 172 173# Access /data/misc/recovery 174allow dumpstate recovery_data_file:dir r_dir_perms; 175allow dumpstate recovery_data_file:file r_file_perms; 176 177# Access /data/misc/profiles/{cur,ref}/ 178userdebug_or_eng(` 179 allow dumpstate user_profile_data_file:dir r_dir_perms; 180 allow dumpstate user_profile_data_file:file r_file_perms; 181') 182 183# Access /data/misc/logd 184userdebug_or_eng(` 185 allow dumpstate misc_logd_file:dir r_dir_perms; 186 allow dumpstate misc_logd_file:file r_file_perms; 187') 188 189allow dumpstate { service_manager_type -gatekeeper_service -dumpstate_service -incident_service -virtual_touchpad_service -vr_hwc_service }:service_manager find; 190allow dumpstate servicemanager:service_manager list; 191allow dumpstate hwservicemanager:hwservice_manager list; 192 193allow dumpstate devpts:chr_file rw_file_perms; 194 195# Set properties. 196# dumpstate_prop is used to share state with the Shell app. 197set_prop(dumpstate, dumpstate_prop) 198# dumpstate_options_prop is used to pass extra command-line args. 199set_prop(dumpstate, dumpstate_options_prop) 200 201# Read device's serial number from system properties 202get_prop(dumpstate, serialno_prop) 203 204# Read state of logging-related properties 205get_prop(dumpstate, device_logging_prop) 206 207# Access to /data/media. 208# This should be removed if sdcardfs is modified to alter the secontext for its 209# accesses to the underlying FS. 210allow dumpstate media_rw_data_file:dir getattr; 211allow dumpstate proc_interrupts:file r_file_perms; 212allow dumpstate proc_zoneinfo:file r_file_perms; 213 214# Create a service for talking back to system_server 215add_service(dumpstate, dumpstate_service) 216 217# use /dev/ion for screen capture 218allow dumpstate ion_device:chr_file r_file_perms; 219 220# read default labeled files in /sys 221r_dir_file(dumpstate, sysfs) 222 223# Allow dumpstate to run top 224allow dumpstate proc_stat:file r_file_perms; 225 226# Allow dumpstate to read backlight details 227allow dumpstate sysfs_leds:lnk_file r_file_perms; 228allow dumpstate sysfs_leds:file r_file_perms; 229allow dumpstate sysfs_leds:dir search; 230 231# Allow dumpstate to talk to installd over binder 232binder_call(dumpstate, installd); 233 234# Allow dumpstate to run ip xfrm policy 235allow dumpstate self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_read }; 236 237### 238### neverallow rules 239### 240 241# dumpstate has capability sys_ptrace, but should only use that capability for 242# accessing sensitive /proc/PID files, never for using ptrace attach. 243neverallow dumpstate *:process ptrace; 244 245# only system_server, dumpstate and shell can find the dumpstate service 246neverallow { domain -system_server -shell -dumpstate } dumpstate_service:service_manager find; 247 248# Dumpstate should not be writing to any generically labeled sysfs files. 249# Create a specific label for the file type 250neverallow dumpstate sysfs:file no_w_file_perms; 251