1# lmkd low memory killer daemon 2type lmkd, domain, mlstrustedsubject; 3type lmkd_exec, system_file_type, exec_type, file_type; 4 5allow lmkd self:global_capability_class_set { dac_override dac_read_search sys_resource kill }; 6 7# lmkd locks itself in memory, to prevent it from being 8# swapped out and unable to kill other memory hogs. 9# system/core commit b28ff9131363f7b4a698990da5748b2a88c3ed35 10# b/16236289 11allow lmkd self:global_capability_class_set ipc_lock; 12 13## Open and write to /proc/PID/oom_score_adj and /proc/PID/timerslack_ns 14## TODO: maybe scope this down? 15r_dir_file(lmkd, domain) 16allow lmkd domain:file write; 17 18## Writes to /sys/module/lowmemorykiller/parameters/minfree 19r_dir_file(lmkd, sysfs_lowmemorykiller) 20allow lmkd sysfs_lowmemorykiller:file w_file_perms; 21 22# setsched and send kill signals to any registered process 23allow lmkd domain:process { setsched sigkill }; 24# TODO: delete this line b/131761776 25allow lmkd kernel:process { setsched }; 26 27# Clean up old cgroups 28allow lmkd cgroup:dir { remove_name rmdir }; 29allow lmkd cgroup_v2:dir { remove_name rmdir }; 30 31# Allow to read memcg stats 32allow lmkd cgroup:file r_file_perms; 33allow lmkd cgroup_v2:file r_file_perms; 34 35# Set self to SCHED_FIFO 36allow lmkd self:global_capability_class_set sys_nice; 37 38allow lmkd proc_zoneinfo:file r_file_perms; 39allow lmkd proc_vmstat:file r_file_perms; 40 41# live lock watchdog process allowed to look through /proc/ 42allow lmkd domain:dir { search open read }; 43allow lmkd domain:file { open read }; 44 45# live lock watchdog process allowed to dump process trace and 46# reboot because orderly shutdown may not be possible. 47allow lmkd proc_sysrq:file rw_file_perms; 48 49# Read /proc/lowmemorykiller 50allow lmkd proc_lowmemorykiller:file r_file_perms; 51 52# Read /proc/meminfo 53allow lmkd proc_meminfo:file r_file_perms; 54 55# Read /proc/pressure/cpu and /proc/pressure/io 56allow lmkd proc_pressure_cpu:file r_file_perms; 57allow lmkd proc_pressure_io:file r_file_perms; 58 59# Read/Write /proc/pressure/memory 60allow lmkd proc_pressure_mem:file rw_file_perms; 61 62# Allow lmkd to connect during reinit. 63allow lmkd lmkd_socket:sock_file write; 64 65# Allow lmkd to write to statsd. 66unix_socket_send(lmkd, statsdw, statsd) 67 68### neverallow rules 69 70# never honor LD_PRELOAD 71neverallow * lmkd:process noatsecure; 72neverallow lmkd self:global_capability_class_set sys_ptrace; 73