1# android user-space log manager 2type logd, domain, mlstrustedsubject; 3type logd_exec, system_file_type, exec_type, file_type; 4 5# Read access to pseudo filesystems. 6r_dir_file(logd, cgroup) 7r_dir_file(logd, cgroup_v2) 8r_dir_file(logd, proc_kmsg) 9r_dir_file(logd, proc_meminfo) 10 11allow logd self:global_capability_class_set { setuid setgid setpcap sys_nice audit_control }; 12allow logd self:global_capability2_class_set syslog; 13allow logd self:netlink_audit_socket { create_socket_perms_no_ioctl nlmsg_write }; 14allow logd kernel:system syslog_read; 15allow logd kmsg_device:chr_file { getattr w_file_perms }; 16allow logd system_data_file:{ file lnk_file } r_file_perms; 17allow logd packages_list_file:file r_file_perms; 18allow logd pstorefs:dir search; 19allow logd pstorefs:file r_file_perms; 20userdebug_or_eng(` 21 # Access to /data/misc/logd/event-log-tags 22 allow logd misc_logd_file:dir r_dir_perms; 23 allow logd misc_logd_file:file rw_file_perms; 24') 25allow logd runtime_event_log_tags_file:file rw_file_perms; 26 27r_dir_file(logd, domain) 28 29allow logd kernel:system syslog_mod; 30 31control_logd(logd) 32read_runtime_log_tags(logd) 33 34allow runtime_event_log_tags_file tmpfs:filesystem associate; 35# Typically harmlessly blindly trying to access via liblog 36# event tag mapping while in the untrusted_app domain. 37# Access for that domain is controlled and gated via the 38# event log tag service (albeit at a performance penalty, 39# expected to be locally cached). 40dontaudit domain runtime_event_log_tags_file:file { map open read }; 41 42# Logd sets defaults if certain properties are empty. 43set_prop(logd, logd_prop) 44 45### 46### Neverallow rules 47### 48### logd should NEVER do any of this 49 50# Block device access. 51neverallow logd dev_type:blk_file { read write }; 52 53# ptrace any other app 54neverallow logd domain:process ptrace; 55 56# ... and nobody may ptrace me (except on userdebug or eng builds) 57neverallow { domain userdebug_or_eng(`-crash_dump -llkd') } logd:process ptrace; 58 59# Write to /system. 60neverallow logd system_file:dir_file_class_set write; 61 62# Write to files in /data/data or system files on /data 63neverallow logd { app_data_file privapp_data_file system_data_file packages_list_file }:dir_file_class_set write; 64 65# Only init is allowed to enter the logd domain via exec() 66neverallow { domain -init } logd:process transition; 67neverallow * logd:process dyntransition; 68 69# protect the event-log-tags file 70neverallow { 71 domain 72 -init 73 -logd 74} runtime_event_log_tags_file:file no_w_file_perms; 75