1# Perfetto command-line client. Can be used only from the domains that are 2# explicitly allowlisted with a domain_auto_trans(X, perfetto_exec, perfetto). 3# This command line client accesses the privileged socket of the traced 4# daemon. 5 6type perfetto_exec, system_file_type, exec_type, file_type; 7type perfetto_tmpfs, file_type; 8 9tmpfs_domain(perfetto); 10 11# Allow init to start a trace (for perfetto_boottrace). 12init_daemon_domain(perfetto) 13 14# Allow to access traced's privileged consumer socket. 15unix_socket_connect(perfetto, traced_consumer, traced) 16 17# Connect to the Perfetto traced daemon as a producer. This requires 18# connecting to its producer socket and obtaining a (per-process) tmpfs fd. 19perfetto_producer(perfetto) 20 21# Allow to write and unlink traces into /data/misc/perfetto-traces. 22allow perfetto perfetto_traces_data_file:dir rw_dir_perms; 23allow perfetto perfetto_traces_data_file:file create_file_perms; 24 25# Allow to write and unlink trace into /data/misc/perfetto-traces/bugreport* 26allow perfetto perfetto_traces_bugreport_data_file:file create_file_perms; 27allow perfetto perfetto_traces_bugreport_data_file:dir rw_dir_perms; 28 29# Allow perfetto to access the proxy service for reporting traces. 30allow perfetto tracingproxy_service:service_manager find; 31binder_use(perfetto) 32binder_call(perfetto, system_server) 33 34# Allow perfetto to read the trace config from /data/misc/perfetto-configs. 35# shell and adb can write files into that directory. 36allow perfetto perfetto_configs_data_file:dir r_dir_perms; 37allow perfetto perfetto_configs_data_file:file r_file_perms; 38 39# Allow perfetto to read the trace config from statsd, mm_events and shell 40# (both root and non-root) on stdin and also to write the resulting trace to 41# stdout. 42allow perfetto { statsd mm_events shell su }:fd use; 43allow perfetto { statsd mm_events shell su }:fifo_file { getattr read write }; 44 45# Allow to communicate use, read and write over the adb connection. 46allow perfetto adbd:fd use; 47allow perfetto adbd:unix_stream_socket { read write }; 48 49# Allow adbd to reap perfetto. 50allow perfetto adbd:process { sigchld }; 51 52# Allow perfetto to write to statsd. 53unix_socket_send(perfetto, statsdw, statsd) 54 55# Allow to access /dev/pts when launched in an adb shell. 56allow perfetto devpts:chr_file rw_file_perms; 57 58# Allow perfetto to ask incidentd to start a report. 59# TODO(lalitm): remove all incidentd rules when proxy service is stable. 60allow perfetto incident_service:service_manager find; 61binder_call(perfetto, incidentd) 62 63# perfetto log formatter calls isatty() on its stderr. Denial when running 64# under adbd is harmless. Avoid generating denial logs. 65dontaudit perfetto adbd:unix_stream_socket getattr; 66dontauditxperm perfetto adbd:unix_stream_socket ioctl unpriv_tty_ioctls; 67# As above, when adbd is running in "su" domain (only the ioctl is denied in 68# practice). 69dontauditxperm perfetto su:unix_stream_socket ioctl unpriv_tty_ioctls; 70# Similarly, CTS tests end up hitting a denial on shell pipes. 71dontauditxperm perfetto shell:fifo_file ioctl unpriv_tty_ioctls; 72 73### 74### Neverallow rules 75### 76 77# Disallow anyone else from being able to handle traces except selected system 78# components. 79neverallow { 80 domain 81 -init # The creator of the folder. 82 -perfetto # The owner of the folder. 83 -adbd # For pulling traces. 84 -shell # For devepment purposes. 85 -traced # For write_into_file traces. 86 -dumpstate # For attaching traces to bugreports. 87 -incidentd # For receiving reported traces. TODO(lalitm): remove this. 88 -priv_app # For stating traces for bug-report UI. 89} perfetto_traces_data_file:dir *; 90neverallow { 91 domain 92 -init # The creator of the folder. 93 -perfetto # The owner of the folder. 94 -adbd # For pulling traces. 95 -shell # For devepment purposes. 96 -traced # For write_into_file traces. 97 -incidentd # For receiving reported traces. TODO(lalitm): remove this. 98} perfetto_traces_data_file:file ~{ getattr read }; 99 100### perfetto should NEVER do any of the following 101 102# Disallow mapping executable memory (execstack and exec are already disallowed 103# globally in domain.te). 104neverallow perfetto self:process execmem; 105 106# Block device access. 107neverallow perfetto dev_type:blk_file { read write }; 108 109# ptrace any other process 110neverallow perfetto domain:process ptrace; 111 112# Disallows access to other /data files. 113neverallow perfetto { 114 data_file_type 115 -system_data_file 116 -system_data_root_file 117 -media_userdir_file 118 -system_userdir_file 119 -vendor_userdir_file 120 # TODO(b/72998741) Remove exemption. Further restricted in a subsequent 121 # neverallow. Currently only getattr and search are allowed. 122 -vendor_data_file 123 -perfetto_traces_data_file 124 -perfetto_traces_bugreport_data_file 125 -perfetto_configs_data_file 126 with_native_coverage(`-method_trace_data_file') 127}:dir *; 128neverallow perfetto { system_data_file -perfetto_traces_data_file }:dir ~{ getattr search }; 129neverallow perfetto { 130 data_file_type 131 -perfetto_traces_data_file 132 -perfetto_traces_bugreport_data_file 133 -perfetto_configs_data_file 134 with_native_coverage(`-method_trace_data_file') 135}:file ~write; 136