1# Domain for atrace process. 2# It is spawned either by traced_probes or by init for the boottrace service. 3 4type atrace_exec, exec_type, file_type, system_file_type; 5 6# boottrace services uses /data/misc/boottrace/categories 7allow atrace boottrace_data_file:dir search; 8allow atrace boottrace_data_file:file r_file_perms; 9 10# Allow atrace to access tracefs. 11allow atrace debugfs_tracing:dir r_dir_perms; 12allow atrace debugfs_tracing:file rw_file_perms; 13allow atrace debugfs_trace_marker:file getattr; 14 15# Allow atrace to write data when a pipe is used for stdout/stderr 16# This is used by Perfetto to capture the output on error in atrace. 17allow atrace traced_probes:fd use; 18allow atrace traced_probes:fifo_file write; 19 20# atrace sets debug.atrace.* properties 21set_prop(atrace, debug_prop) 22 23# atrace pokes all the binder-enabled processes at startup with a 24# SYSPROPS_TRANSACTION, to tell them to reload the debug.atrace.* properties. 25 26# Allow discovery of binder services. 27allow atrace { 28 service_manager_type 29 -apex_service 30 -dnsresolver_service 31 -dumpstate_service 32 -incident_service 33 -installd_service 34 -iorapd_service 35 -lpdump_service 36 -netd_service 37 -stats_service 38 -tracingproxy_service 39 -vold_service 40 -default_android_service 41}:service_manager { find }; 42allow atrace servicemanager:service_manager list; 43 44# Allow notifying the processes hosting specific binder services that 45# trace-related system properties have changed. 46binder_use(atrace) 47allow atrace healthd:binder call; 48allow atrace surfaceflinger:binder call; 49allow atrace system_server:binder call; 50allow atrace cameraserver:binder call; 51 52# Similarly, on debug builds, allow specific HALs to be notified that 53# trace-related system properties have changed. 54userdebug_or_eng(` 55 # List HAL interfaces. 56 allow atrace hwservicemanager:hwservice_manager list; 57 # Notify the camera HAL. 58 hal_client_domain(atrace, hal_camera) 59 hal_client_domain(atrace, hal_vibrator) 60') 61 62# Remove logspam from notification attempts to non-allowlisted services. 63dontaudit atrace hwservice_manager_type:hwservice_manager find; 64dontaudit atrace service_manager_type:service_manager find; 65dontaudit atrace domain:binder call; 66 67# atrace can call atrace HAL 68hal_client_domain(atrace, hal_atrace) 69 70get_prop(atrace, hwservicemanager_prop) 71 72userdebug_or_eng(` 73 # atrace is generally invoked as a standalone binary from shell or perf 74 # daemons like Perfetto traced_probes. However, in userdebug builds, there is 75 # a further option to run atrace as an init daemon for boot tracing. 76 init_daemon_domain(atrace) 77 78 allow atrace debugfs_tracing_debug:dir r_dir_perms; 79 allow atrace debugfs_tracing_debug:file rw_file_perms; 80') 81