1# bootstat command 2type bootstat, domain; 3type bootstat_exec, system_file_type, exec_type, file_type; 4 5read_runtime_log_tags(bootstat) 6 7# Allow persistent storage in /data/misc/bootstat. 8allow bootstat bootstat_data_file:dir rw_dir_perms; 9allow bootstat bootstat_data_file:file create_file_perms; 10 11# Collect metrics on boot time created by init 12get_prop(bootstat, boottime_prop) 13 14# Read/Write [persist.]sys.boot.reason and ro.boot.bootreason (write if empty) 15set_prop(bootstat, bootloader_boot_reason_prop) 16set_prop(bootstat, system_boot_reason_prop) 17set_prop(bootstat, last_boot_reason_prop) 18allow bootstat metadata_file:dir search; 19allow bootstat metadata_bootstat_file:dir rw_dir_perms; 20allow bootstat metadata_bootstat_file:file create_file_perms; 21 22# ToDo: TBI move access for the following to a system health HAL 23 24# Allow access to /sys/fs/pstore/ and syslog 25allow bootstat pstorefs:dir search; 26allow bootstat pstorefs:file r_file_perms; 27allow bootstat kernel:system syslog_read; 28 29# Allow access to reading the logs to read aspects of system health 30read_logd(bootstat) 31 32# Allow bootstat write to statsd. 33unix_socket_send(bootstat, statsdw, statsd) 34 35# ToDo: end 36 37neverallow { 38 domain 39 -bootanim 40 -bootstat 41 -dumpstate 42 userdebug_or_eng(`-incidentd') 43 -init 44 -recovery 45 -shell 46 -system_server 47} { bootloader_boot_reason_prop last_boot_reason_prop }:file r_file_perms; 48# ... and refine, as these components should not set the last boot reason 49neverallow { bootanim recovery } last_boot_reason_prop:file r_file_perms; 50 51neverallow { 52 domain 53 -bootstat 54 -init 55 -system_server 56} { bootloader_boot_reason_prop last_boot_reason_prop }:property_service set; 57# ... and refine ... for a ro propertly no less ... keep this _tight_ 58neverallow system_server bootloader_boot_reason_prop:property_service set; 59 60neverallow { 61 domain 62 -bootstat 63 -init 64} system_boot_reason_prop:property_service set; 65