1# Perfetto command-line client. Can be used only from the domains that are 2# explicitly allowlisted with a domain_auto_trans(X, perfetto_exec, perfetto). 3# This command line client accesses the privileged socket of the traced 4# daemon. 5 6type perfetto, domain, coredomain; 7type perfetto_exec, exec_type, file_type; 8 9tmpfs_domain(perfetto); 10 11# Allow to access traced's privileged consumer socket. 12unix_socket_connect(perfetto, traced_consumer, traced) 13 14# Allow to write and unlink traces into /data/misc/perfetto-traces. 15allow perfetto perfetto_traces_data_file:dir rw_dir_perms; 16allow perfetto perfetto_traces_data_file:file create_file_perms; 17 18# Allow to access binder to pass the traces to Dropbox. 19binder_use(perfetto) 20binder_call(perfetto, system_server) 21allow perfetto dropbox_service:service_manager find; 22 23# Allow statsd and shell to pipe the trace config to perfetto on stdin and to 24# print out on stdout/stderr. 25allow perfetto statsd:fd use; 26allow perfetto statsd:fifo_file { getattr read write }; 27allow perfetto shell:fd use; 28allow perfetto shell:fifo_file { getattr read write }; 29 30# Allow to communicate use, read and write over the adb connection. 31allow perfetto adbd:fd use; 32allow perfetto adbd:unix_stream_socket { read write }; 33 34# allow adbd to reap perfetto 35allow perfetto adbd:process { sigchld }; 36 37# Allow to access /dev/pts when launched in an adb shell. 38allow perfetto devpts:chr_file rw_file_perms; 39 40### 41### Neverallow rules 42### 43### perfetto should NEVER do any of this 44 45# Disallow mapping executable memory (execstack and exec are already disallowed 46# globally in domain.te). 47neverallow perfetto self:process execmem; 48 49# Block device access. 50neverallow perfetto dev_type:blk_file { read write }; 51 52# ptrace any other process 53neverallow perfetto domain:process ptrace; 54 55# Disallows access to other /data files. 56neverallow perfetto { 57 data_file_type 58 -system_data_file 59 # TODO(b/72998741) Remove exemption. Further restricted in a subsequent 60 # neverallow. Currently only getattr and search are allowed. 61 -vendor_data_file 62 -zoneinfo_data_file 63 -perfetto_traces_data_file 64}:dir *; 65neverallow perfetto { system_data_file -perfetto_traces_data_file }:dir ~{ getattr search }; 66neverallow perfetto zoneinfo_data_file:dir ~r_dir_perms; 67neverallow perfetto { data_file_type -zoneinfo_data_file -perfetto_traces_data_file }:lnk_file *; 68neverallow perfetto { data_file_type -zoneinfo_data_file -perfetto_traces_data_file }:file ~write; 69