1typeattribute dumpstate coredomain; 2type dumpstate_tmpfs, file_type; 3 4init_daemon_domain(dumpstate) 5 6# Execute and transition to the vdc domain 7domain_auto_trans(dumpstate, vdc_exec, vdc) 8 9# Acquire advisory lock on /system/etc/xtables.lock from ip[6]tables 10allow dumpstate system_file:file lock; 11 12allow dumpstate storaged_exec:file rx_file_perms; 13 14# /data/misc/a11ytrace for accessibility traces 15userdebug_or_eng(` 16 allow dumpstate accessibility_trace_data_file:dir r_dir_perms; 17 allow dumpstate accessibility_trace_data_file:file r_file_perms; 18') 19 20# /data/misc/wmtrace for wm traces 21userdebug_or_eng(` 22 allow dumpstate wm_trace_data_file:dir r_dir_perms; 23 allow dumpstate wm_trace_data_file:file r_file_perms; 24') 25 26# Allow dumpstate to make binder calls to incidentd 27binder_call(dumpstate, incidentd) 28 29# Allow dumpstate to make binder calls to storaged service 30binder_call(dumpstate, storaged) 31 32# Allow dumpstate to make binder calls to statsd 33binder_call(dumpstate, statsd) 34 35# Allow dumpstate to talk to gpuservice over binder 36binder_call(dumpstate, gpuservice); 37 38# Allow dumpstate to talk to idmap over binder 39binder_call(dumpstate, idmap); 40 41# Allow dumpstate to talk to profcollectd over binder 42userdebug_or_eng(` 43 binder_call(dumpstate, profcollectd) 44') 45 46# Collect metrics on boot time created by init 47get_prop(dumpstate, boottime_prop) 48 49# Signal native processes to dump their stack. 50allow dumpstate { 51 mediatranscoding 52 statsd 53 netd 54}:process signal; 55 56userdebug_or_eng(` 57 allow dumpstate keystore:process signal; 58') 59 60# For collecting bugreports. 61no_debugfs_restriction(` 62 allow dumpstate debugfs_wakeup_sources:file r_file_perms; 63') 64 65allow dumpstate dev_type:blk_file getattr; 66allow dumpstate webview_zygote:process signal; 67allow dumpstate sysfs_dmabuf_stats:file r_file_perms; 68dontaudit dumpstate update_engine:binder call; 69 70# Read files in /proc 71allow dumpstate { 72 proc_net_tcp_udp 73 proc_pid_max 74}:file r_file_perms; 75 76# For comminucating with the system process to do confirmation ui. 77binder_call(dumpstate, incidentcompanion_service) 78 79# Set properties. 80# dumpstate_prop is used to share state with the Shell app. 81set_prop(dumpstate, dumpstate_prop) 82set_prop(dumpstate, exported_dumpstate_prop) 83 84# dumpstate_options_prop is used to pass extra command-line args. 85set_prop(dumpstate, dumpstate_options_prop) 86 87# Allow dumpstate to kill vendor dumpstate service by init 88set_prop(dumpstate, ctl_dumpstate_prop) 89 90# For dumping dynamic partition information. 91set_prop(dumpstate, lpdumpd_prop) 92binder_call(dumpstate, lpdumpd) 93 94# For dumping device-mapper and snapshot information. 95allow dumpstate gsid_exec:file rx_file_perms; 96set_prop(dumpstate, ctl_gsid_prop) 97binder_call(dumpstate, gsid) 98 99r_dir_file(dumpstate, ota_metadata_file) 100 101# For starting (and killing) perfetto --save-for-bugreport. If a labelled trace 102# is being recorded, the command above will serialize it into 103# /data/misc/perfetto-traces/bugreport/*.pftrace . 104domain_auto_trans(dumpstate, perfetto_exec, perfetto) 105allow dumpstate perfetto:process signal; 106allow dumpstate perfetto_traces_data_file:dir { search }; 107allow dumpstate perfetto_traces_bugreport_data_file:dir rw_dir_perms; 108allow dumpstate perfetto_traces_bugreport_data_file:file { r_file_perms unlink }; 109 110# When exec-ing /system/bin/perfetto, dumpstates redirects stdio to /dev/null 111# (which is labelled as dumpstate_tmpfs) to avoid leaking a FD to the bugreport 112# zip file. These rules are to allow perfetto.te to inherit dumpstate's 113# /dev/null. 114allow perfetto dumpstate_tmpfs:file rw_file_perms; 115allow perfetto dumpstate:fd use; 116