1type uprobestats, domain, coredomain; 2 3typeattribute uprobestats bpfdomain; 4 5type uprobestats_exec, system_file_type, exec_type, file_type; 6 7# Allow init to start uprobestats. 8init_daemon_domain(uprobestats) 9 10allow uprobestats fs_bpf_uprobestats:file { read write }; 11allow uprobestats fs_bpf_uprobestats:dir search; 12allow uprobestats bpfloader:bpf { map_read map_write prog_run }; 13allow uprobestats self:capability2 perfmon; 14allow uprobestats self:perf_event { cpu open write }; 15allow uprobestats sysfs_uprobe:file { open read }; 16allow uprobestats sysfs_uprobe:dir { search }; 17 18allow uprobestats { apex_art_data_file apex_module_data_file }:dir r_dir_perms; 19allow uprobestats { apex_art_data_file apex_module_data_file }:file r_file_perms; 20allow uprobestats packages_list_file:file r_file_perms; 21 22# Allow uprobestats to popen oatdump. 23allow uprobestats system_file:file rx_file_perms; 24 25# Allow uprobestats to write atoms to statsd 26unix_socket_send(uprobestats, statsdw, statsd) 27 28# For registration with system server as a process observer. 29binder_use(uprobestats) 30allow uprobestats activity_service:service_manager find; 31allow uprobestats dynamic_instrumentation_service:service_manager find; 32binder_call(uprobestats, system_server); 33 34# Allow uprobestats to talk to native package manager 35allow uprobestats package_native_service:service_manager find; 36 37# Allow uprobestats to scan /proc/<pid>/cmdline. 38r_dir_file(uprobestats, { domain -appdomain }) 39 40# Allow uprobestats to manage its own config files. 41allow uprobestats uprobestats_configs_data_file:dir rw_dir_perms; 42allow uprobestats uprobestats_configs_data_file:file { r_file_perms unlink }; 43