1typeattribute dumpstate coredomain; 2type dumpstate_tmpfs, file_type; 3 4init_daemon_domain(dumpstate) 5 6# Execute and transition to the vdc domain 7domain_auto_trans(dumpstate, vdc_exec, vdc) 8 9# Create tmpfs files for using memfd descriptors to get output from child 10# processes. 11tmpfs_domain(dumpstate) 12 13# Acquire advisory lock on /system/etc/xtables.lock from ip[6]tables 14allow dumpstate system_file:file lock; 15 16allow dumpstate storaged_exec:file rx_file_perms; 17 18# /data/misc/a11ytrace for accessibility traces 19userdebug_or_eng(` 20 allow dumpstate accessibility_trace_data_file:dir r_dir_perms; 21 allow dumpstate accessibility_trace_data_file:file r_file_perms; 22') 23 24# /data/misc/wmtrace for wm traces 25userdebug_or_eng(` 26 allow dumpstate wm_trace_data_file:dir r_dir_perms; 27 allow dumpstate wm_trace_data_file:file r_file_perms; 28') 29 30# /data/system/dropbox for dropbox entries 31userdebug_or_eng(` 32 allow dumpstate dropbox_data_file:dir r_dir_perms; 33 allow dumpstate dropbox_data_file:file r_file_perms; 34') 35 36r_dir_file(dumpstate, aconfig_storage_metadata_file); 37 38# Allow dumpstate to make binder calls to incidentd 39binder_call(dumpstate, incidentd) 40 41# Kill incident in case of a timeout 42allow dumpstate incident:process { signal sigkill }; 43 44# Allow dumpstate to make binder calls to storaged service 45binder_call(dumpstate, storaged) 46 47# Allow dumpstate to make binder calls to statsd 48binder_call(dumpstate, statsd) 49 50# Allow dumpstate to talk to gpuservice over binder 51binder_call(dumpstate, gpuservice); 52 53# Allow dumpstate to talk to idmap over binder 54binder_call(dumpstate, idmap); 55 56# Allow dumpstate to talk to profcollectd over binder 57userdebug_or_eng(` 58 binder_call(dumpstate, profcollectd) 59') 60 61# Allow dumpstate to talk to automotive_display_service over binder 62binder_call(dumpstate, automotive_display_service) 63 64# Allow dumpstate to talk to virtual_camera service over binder 65binder_call(dumpstate, virtual_camera) 66 67# Allow dumpstate to talk to ot_daemon service over binder 68binder_call(dumpstate, ot_daemon) 69 70# Collect metrics on boot time created by init 71get_prop(dumpstate, boottime_prop) 72 73get_prop(dumpstate, misctrl_prop) 74 75# Signal native processes to dump their stack. 76allow dumpstate { 77 mediatranscoding 78 statsd 79 netd 80 virtual_camera 81 ot_daemon 82}:process signal; 83 84# Only allow dumpstate to dump Keystore on debuggable builds. 85userdebug_or_eng(` 86 allow dumpstate keystore:process signal; 87') 88dontaudit dumpstate keystore:process { signal }; 89 90# For collecting bugreports. 91no_debugfs_restriction(` 92 allow dumpstate debugfs_wakeup_sources:file r_file_perms; 93') 94 95allow dumpstate dev_type:blk_file getattr; 96allow dumpstate webview_zygote:process signal; 97allow dumpstate sysfs_dmabuf_stats:file r_file_perms; 98dontaudit dumpstate update_engine:binder call; 99 100# Read files in /proc 101allow dumpstate { 102 config_gz 103 proc_net_tcp_udp 104 proc_pid_max 105}:file r_file_perms; 106 107# For comminucating with the system process to do confirmation ui. 108binder_call(dumpstate, incidentcompanion_service) 109 110# Set properties. 111# dumpstate_prop is used to share state with the Shell app. 112set_prop(dumpstate, dumpstate_prop) 113set_prop(dumpstate, exported_dumpstate_prop) 114 115# dumpstate_options_prop is used to pass extra command-line args. 116set_prop(dumpstate, dumpstate_options_prop) 117 118# Allow dumpstate to kill vendor dumpstate service by init 119set_prop(dumpstate, ctl_dumpstate_prop) 120 121# For dumping dynamic partition information. 122set_prop(dumpstate, lpdumpd_prop) 123binder_call(dumpstate, lpdumpd) 124 125# For dumping hypervisor information. 126get_prop(dumpstate, hypervisor_prop) 127 128# For dumping device-mapper and snapshot information. 129allow dumpstate gsid_exec:file rx_file_perms; 130set_prop(dumpstate, ctl_gsid_prop) 131binder_call(dumpstate, gsid) 132 133#Allow access to /dev/binderfs/binder_logs 134userdebug_or_eng(` 135 allow dumpstate binderfs_logs_transactions:file r_file_perms; 136') 137dontaudit dumpstate binderfs_logs_transactions:file r_file_perms; 138allow dumpstate binderfs_logs_transaction_history:file r_file_perms; 139 140r_dir_file(dumpstate, ota_metadata_file) 141 142# For starting (and killing) perfetto --save-for-bugreport. If a labelled trace 143# is being recorded, the command above will serialize it into 144# /data/misc/perfetto-traces/bugreport/*.pftrace . 145domain_auto_trans(dumpstate, perfetto_exec, perfetto) 146allow dumpstate perfetto:process signal; 147allow dumpstate perfetto_traces_data_file:dir { search }; 148allow dumpstate perfetto_traces_bugreport_data_file:dir rw_dir_perms; 149allow dumpstate perfetto_traces_bugreport_data_file:file { r_file_perms unlink }; 150 151# When exec-ing /system/bin/perfetto, dumpstates redirects stdio to /dev/null 152# (which is labelled as dumpstate_tmpfs) to avoid leaking a FD to the bugreport 153# zip file. These rules are to allow perfetto.te to inherit dumpstate's 154# /dev/null. 155allow perfetto dumpstate_tmpfs:file rw_file_perms; 156allow perfetto dumpstate:fd use; 157 158# system_dlkm_file for /system_dlkm partition 159allow dumpstate system_dlkm_file:dir getattr; 160 161# Allow dumpstate to execute derive_sdk in its own domain 162domain_auto_trans(dumpstate, derive_sdk_exec, derive_sdk) 163 164net_domain(dumpstate) 165binder_use(dumpstate) 166wakelock_use(dumpstate) 167 168# Allow setting process priority, protect from OOM killer, and dropping 169# privileges by switching UID / GID 170allow dumpstate self:global_capability_class_set { setuid setgid sys_resource }; 171 172# Allow dumpstate to scan through /proc/pid for all processes 173r_dir_file(dumpstate, domain) 174 175allow dumpstate self:global_capability_class_set { 176 # Send signals to processes 177 kill 178 # Run iptables 179 net_raw 180 net_admin 181}; 182 183# Allow executing files on system, such as: 184# /system/bin/toolbox 185# /system/bin/logcat 186# /system/bin/dumpsys 187allow dumpstate system_file:file execute_no_trans; 188not_full_treble(`allow dumpstate vendor_file:file execute_no_trans;') 189allow dumpstate toolbox_exec:file rx_file_perms; 190 191# hidl searches for files in /system/lib(64)/hw/ 192allow dumpstate system_file:dir r_dir_perms; 193 194# Create and write into /data/anr/ 195allow dumpstate self:global_capability_class_set { dac_override dac_read_search chown fowner fsetid }; 196allow dumpstate anr_data_file:dir rw_dir_perms; 197allow dumpstate anr_data_file:file create_file_perms; 198 199# Allow reading /data/system/uiderrors.txt 200# TODO: scope this down. 201allow dumpstate system_data_file:file r_file_perms; 202 203# Allow dumpstate to append into apps' private files. 204allow dumpstate app_data_file_type:file append; 205 206# Read dmesg 207allow dumpstate self:global_capability2_class_set syslog; 208allow dumpstate kernel:system syslog_read; 209 210# Read /sys/fs/pstore/console-ramoops 211allow dumpstate pstorefs:dir r_dir_perms; 212allow dumpstate pstorefs:file r_file_perms; 213 214# Get process attributes 215allow dumpstate domain:process getattr; 216 217# Signal java processes to dump their stack 218allow dumpstate { appdomain system_server zygote app_zygote }:process signal; 219 220# Signal native processes to dump their stack. 221allow dumpstate { 222 # This list comes from native_processes_to_dump in dumputils/dump_utils.c 223 audioserver 224 cameraserver 225 drmserver 226 inputflinger 227 mediadrmserver 228 mediaextractor 229 mediametrics 230 mediaserver 231 mediaswcodec 232 sdcardd 233 surfaceflinger 234 vold 235 236 # This list comes from hal_interfaces_to_dump in dumputils/dump_utils.c 237 evsmanagerd 238 hal_audio_server 239 hal_audiocontrol_server 240 hal_bluetooth_server 241 hal_broadcastradio_server 242 hal_camera_server 243 hal_codec2_server 244 hal_drm_server 245 hal_evs_server 246 hal_face_server 247 hal_fingerprint_server 248 hal_graphics_allocator_server 249 hal_graphics_composer_server 250 hal_health_server 251 hal_input_processor_server 252 hal_neuralnetworks_server 253 hal_omx_server 254 hal_power_server 255 hal_power_stats_server 256 hal_sensors_server 257 hal_thermal_server 258 hal_vehicle_server 259 hal_vr_server 260 system_suspend_server 261}:process signal; 262 263# On userdebug, dumpstate may fork and execute a command as su. Make sure the 264# timeout logic is allowed to terminate the child process if necessary. 265userdebug_or_eng(` 266 allow dumpstate su:process { signal sigkill }; 267') 268 269# Connect to tombstoned to intercept dumps. 270unix_socket_connect(dumpstate, tombstoned_intercept, tombstoned) 271 272# Access to /sys 273allow dumpstate sysfs_type:dir r_dir_perms; 274 275allow dumpstate { 276 sysfs_devices_block 277 sysfs_dm 278 sysfs_loop 279 sysfs_usb 280 sysfs_zram 281}:file r_file_perms; 282 283# Ignore other file access under /sys. 284dontaudit dumpstate sysfs:file r_file_perms; 285 286# Other random bits of data we want to collect 287no_debugfs_restriction(` 288 allow dumpstate debugfs:file r_file_perms; 289 auditallow dumpstate debugfs:file r_file_perms; 290 291 allow dumpstate debugfs_mmc:file r_file_perms; 292') 293 294# df for 295allow dumpstate { 296 block_device 297 cache_file 298 metadata_file 299 rootfs 300 selinuxfs 301 storage_file 302 tmpfs 303}:dir { search getattr }; 304allow dumpstate fuse_device:chr_file getattr; 305allow dumpstate { dm_device cache_block_device }:blk_file getattr; 306allow dumpstate { cache_file rootfs }:lnk_file { getattr read }; 307 308# Read /dev/cpuctl and /dev/cpuset 309r_dir_file(dumpstate, cgroup) 310r_dir_file(dumpstate, cgroup_v2) 311 312# Allow dumpstate to make binder calls to any binder service 313binder_call(dumpstate, binderservicedomain) 314binder_call(dumpstate, { appdomain artd netd wificond }) 315 316# Allow dumpstate to call dump() on specific hals. 317dump_hal(hal_audio) 318dump_hal(hal_audiocontrol) 319dump_hal(hal_authgraph) 320dump_hal(hal_authsecret) 321dump_hal(hal_bluetooth) 322dump_hal(hal_broadcastradio) 323dump_hal(hal_camera) 324dump_hal(hal_codec2) 325dump_hal(hal_contexthub) 326dump_hal(hal_drm) 327dump_hal(hal_dumpstate) 328dump_hal(hal_evs) 329dump_hal(hal_face) 330dump_hal(hal_fingerprint) 331dump_hal(hal_gnss) 332dump_hal(hal_graphics_allocator) 333dump_hal(hal_graphics_composer) 334dump_hal(hal_health) 335dump_hal(hal_identity) 336dump_hal(hal_input_processor) 337dump_hal(hal_keymint) 338dump_hal(hal_light) 339dump_hal(hal_memtrack) 340dump_hal(hal_neuralnetworks) 341dump_hal(hal_nfc) 342dump_hal(hal_oemlock) 343dump_hal(hal_power) 344dump_hal(hal_power_stats) 345dump_hal(hal_rebootescrow) 346dump_hal(hal_secretkeeper) 347dump_hal(hal_sensors) 348dump_hal(hal_thermal) 349dump_hal(hal_vehicle) 350dump_hal(hal_vm_capabilities) 351dump_hal(hal_weaver) 352dump_hal(hal_wifi) 353 354# Vibrate the device after we are done collecting the bugreport 355hal_client_domain(dumpstate, hal_vibrator) 356 357# Reading /proc/PID/maps of other processes 358allow dumpstate self:global_capability_class_set sys_ptrace; 359 360# Allow the bugreport service to create a file in 361# /data/data/com.android.shell/files/bugreports/bugreport 362allow dumpstate shell_data_file:dir create_dir_perms; 363allow dumpstate shell_data_file:file create_file_perms; 364 365# Run a shell. 366allow dumpstate shell_exec:file rx_file_perms; 367 368# For running am and similar framework commands. 369# Run /system/bin/app_process. 370allow dumpstate zygote_exec:file rx_file_perms; 371 372# For Bluetooth 373allow dumpstate bluetooth_data_file:dir search; 374allow dumpstate bluetooth_logs_data_file:dir r_dir_perms; 375allow dumpstate bluetooth_logs_data_file:file r_file_perms; 376 377# For Nfc 378allow dumpstate nfc_logs_data_file:dir r_dir_perms; 379allow dumpstate nfc_logs_data_file:file r_file_perms; 380 381# For uwb 382allow dumpstate apex_module_data_file:dir search; 383allow dumpstate apex_system_server_data_file:dir search; 384allow dumpstate apex_uwb_data_file:dir r_dir_perms; 385allow dumpstate apex_uwb_data_file:file r_file_perms; 386 387# Dumpstate calls screencap, which grabs a screenshot. Needs gpu access 388allow dumpstate gpu_device:chr_file rw_file_perms; 389allow dumpstate gpu_device:dir r_dir_perms; 390 391# logd access 392read_logd(dumpstate) 393control_logd(dumpstate) 394read_runtime_log_tags(dumpstate) 395 396# Read files in /proc 397allow dumpstate { 398 proc_allocinfo 399 proc_bootconfig 400 proc_buddyinfo 401 proc_cmdline 402 proc_meminfo 403 proc_modules 404 proc_net_type 405 proc_pipe_conf 406 proc_pagetypeinfo 407 proc_qtaguid_ctrl 408 proc_qtaguid_stat 409 proc_slabinfo 410 proc_version 411 proc_vmallocinfo 412 proc_vmstat 413}:file r_file_perms; 414 415# Read network state info files. 416allow dumpstate net_data_file:dir search; 417allow dumpstate net_data_file:file r_file_perms; 418 419# List sockets via ss. 420allow dumpstate self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read }; 421 422# Access /data/tombstones. 423allow dumpstate tombstone_data_file:dir r_dir_perms; 424allow dumpstate tombstone_data_file:file r_file_perms; 425 426# Access /cache/recovery 427allow dumpstate cache_recovery_file:dir r_dir_perms; 428allow dumpstate cache_recovery_file:file r_file_perms; 429 430# Access /data/misc/recovery 431allow dumpstate recovery_data_file:dir r_dir_perms; 432allow dumpstate recovery_data_file:file r_file_perms; 433 434# Access /data/misc/update_engine & /data/misc/update_engine_log 435allow dumpstate { update_engine_data_file update_engine_log_data_file }:dir r_dir_perms; 436allow dumpstate { update_engine_data_file update_engine_log_data_file }:file r_file_perms; 437# Access /data/misc/snapuserd_log 438allow dumpstate snapuserd_log_data_file:dir r_dir_perms; 439allow dumpstate snapuserd_log_data_file:file r_file_perms; 440 441# Access /data/misc/profiles/{cur,ref}/ 442userdebug_or_eng(` 443 allow dumpstate { user_profile_root_file user_profile_data_file}:dir r_dir_perms; 444 allow dumpstate user_profile_data_file:file r_file_perms; 445') 446 447# Access /data/misc/logd 448allow dumpstate misc_logd_file:dir r_dir_perms; 449allow dumpstate misc_logd_file:file r_file_perms; 450 451# Access /data/misc/prereboot 452allow dumpstate prereboot_data_file:dir r_dir_perms; 453allow dumpstate prereboot_data_file:file r_file_perms; 454 455allow dumpstate app_fuse_file:dir r_dir_perms; 456allow dumpstate overlayfs_file:dir r_dir_perms; 457 458allow dumpstate { 459 service_manager_type 460 -apex_service 461 -dumpstate_service 462 -gatekeeper_service 463 -hal_service_type 464 -virtual_touchpad_service 465 -vold_service 466 -fwk_vold_service 467 -default_android_service 468}:service_manager find; 469# suppress denials for services dumpstate should not be accessing. 470dontaudit dumpstate { 471 apex_service 472 dumpstate_service 473 gatekeeper_service 474 hal_service_type 475 virtual_touchpad_service 476 vold_service 477 fwk_vold_service 478}:service_manager find; 479 480# Most of these are neverallowed. 481dontaudit dumpstate hwservice_manager_type:hwservice_manager find; 482 483allow dumpstate servicemanager:service_manager list; 484allow dumpstate hwservicemanager:hwservice_manager list; 485 486allow dumpstate devpts:chr_file rw_file_perms; 487 488# Read any system properties 489get_prop(dumpstate, property_type) 490 491# Access to /data/media. 492# This should be removed if sdcardfs is modified to alter the secontext for its 493# accesses to the underlying FS. 494allow dumpstate media_rw_data_file:dir getattr; 495allow dumpstate proc_interrupts:file r_file_perms; 496allow dumpstate proc_zoneinfo:file r_file_perms; 497 498# Create a service for talking back to system_server 499add_service(dumpstate, dumpstate_service) 500 501# use /dev/ion for screen capture 502allow dumpstate ion_device:chr_file r_file_perms; 503 504# Allow dumpstate to run top 505allow dumpstate proc_stat:file r_file_perms; 506 507allow dumpstate proc_pressure_cpu:file r_file_perms; 508allow dumpstate proc_pressure_mem:file r_file_perms; 509allow dumpstate proc_pressure_io:file r_file_perms; 510 511# Allow dumpstate to run ps 512allow dumpstate proc_pid_max:file r_file_perms; 513 514# Allow dumpstate to talk to installd over binder 515binder_call(dumpstate, installd); 516 517# Allow dumpstate to run ip xfrm policy 518allow dumpstate self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_read }; 519 520# Allow dumpstate to run iotop 521allow dumpstate self:netlink_socket create_socket_perms_no_ioctl; 522# newer kernels (e.g. 4.4) have a new class for sockets 523allow dumpstate self:netlink_generic_socket create_socket_perms_no_ioctl; 524 525# Allow dumpstate to run ss 526allow dumpstate { domain pdx_channel_socket_type pdx_endpoint_socket_type }:socket_class_set getattr; 527 528# Allow dumpstate to read linkerconfig directory 529allow dumpstate linkerconfig_file:dir { read open }; 530 531# For when dumpstate runs df 532dontaudit dumpstate { 533 mnt_vendor_file 534 mirror_data_file 535 mnt_user_file 536 mnt_product_file 537}:dir search; 538dontaudit dumpstate { 539 apex_mnt_dir 540 linkerconfig_file 541 mirror_data_file 542 mnt_user_file 543 vm_data_file 544}:dir getattr; 545 546#suppress denials for dumpstate to call vitualizationservice. 547dontaudit dumpstate virtualizationservice:binder { call }; 548 549# Allow dumpstate to talk to bufferhubd over binder 550binder_call(dumpstate, bufferhubd); 551 552# Allow dumpstate to talk to mediaswcodec over binder 553binder_call(dumpstate, mediaswcodec); 554 555#Access /data/misc/snapshotctl_log 556allow dumpstate snapshotctl_log_data_file:dir r_dir_perms; 557allow dumpstate snapshotctl_log_data_file:file r_file_perms; 558 559#Allow access to /dev/binderfs/binder_logs 560allow dumpstate binderfs_logs:dir r_dir_perms; 561allow dumpstate binderfs_logs:file r_file_perms; 562allow dumpstate binderfs_logs_proc:file r_file_perms; 563allow dumpstate binderfs_logs_stats:file r_file_perms; 564 565use_apex_info(dumpstate) 566 567# Allow reading files under /data/system/shutdown-checkpoints/ 568allow dumpstate shutdown_checkpoints_system_data_file:dir r_dir_perms; 569allow dumpstate shutdown_checkpoints_system_data_file:file r_file_perms; 570 571### 572### neverallow rules 573### 574 575# dumpstate has capability sys_ptrace, but should only use that capability for 576# accessing sensitive /proc/PID files, never for using ptrace attach. 577neverallow dumpstate *:process ptrace; 578 579# only system_server, dumpstate, traceur_app and shell can find the dumpstate service 580neverallow { 581 domain 582 -system_server 583 -shell 584 -traceur_app 585 -dumpstate 586} dumpstate_service:service_manager find; 587 588# only dumpstate, system_server and related others to access apex_uwb_data_file 589neverallow { 590 domain 591 -dumpstate 592 -system_server 593 -apexd 594 -init 595 -vold_prepare_subdirs 596} apex_uwb_data_file:dir no_rw_file_perms; 597neverallow { 598 domain 599 -dumpstate 600 -system_server 601 -apexd 602 -init 603 -vold_prepare_subdirs 604} apex_uwb_data_file:file no_rw_file_perms; 605