1typeattribute incidentd coredomain; 2 3init_daemon_domain(incidentd) 4type incidentd_exec, exec_type, file_type; 5binder_use(incidentd) 6wakelock_use(incidentd) 7 8# Allow setting process priority, protect from OOM killer, and dropping 9# privileges by switching UID / GID 10# TODO allow incidentd self:capability { setuid setgid sys_resource }; 11 12# Allow incidentd to scan through /proc/pid for all processes 13r_dir_file(incidentd, domain) 14 15allow incidentd self:capability { 16 # Send signals to processes 17 kill 18}; 19 20# Allow executing files on system, such as: 21# /system/bin/toolbox 22# /system/bin/logcat 23# /system/bin/dumpsys 24allow incidentd system_file:file execute_no_trans; 25allow incidentd toolbox_exec:file rx_file_perms; 26 27# Create and write into /data/misc/incidents 28allow incidentd incident_data_file:dir rw_dir_perms; 29allow incidentd incident_data_file:file create_file_perms; 30 31# Get process attributes 32# TODO allow incidentd domain:process getattr; 33 34# Signal java processes to dump their stack and get the results 35# TODO allow incidentd { appdomain ephemeral_app system_server }:process signal; 36# TODO allow incidentd anr_data_file:dir rw_dir_perms; 37# TODO allow incidentd anr_data_file:file create_file_perms; 38 39# Signal native processes to dump their stack. 40# This list comes from native_processes_to_dump in incidentd/utils.c 41allow incidentd { 42 audioserver 43 cameraserver 44 drmserver 45 inputflinger 46 mediacodec 47 mediadrmserver 48 mediaextractor 49 mediaserver 50 sdcardd 51 surfaceflinger 52}:process signal; 53 54# Allow incidentd to make binder calls to any binder service 55binder_call(incidentd, binderservicedomain) 56binder_call(incidentd, appdomain) 57 58# Reading /proc/PID/maps of other processes 59# TODO allow incidentd self:capability sys_ptrace; 60 61# Run a shell. 62allow incidentd shell_exec:file rx_file_perms; 63 64# logd access - work to be done is a PII safe log (possibly an event log?) 65# TODO read_logd(incidentd) 66# TODO control_logd(incidentd) 67 68# Allow incidentd to find these standard groups of services. 69# Others can be whitelisted individually. 70allow incidentd { 71 system_server_service 72 app_api_service 73 system_api_service 74}:service_manager find; 75 76# Only incidentd can publish the binder service 77add_service(incidentd, incident_service) 78 79# Allow pipes from (and only from) incident 80allow incidentd incident:fd use; 81allow incidentd incident:fifo_file write; 82 83# Allow incident to call back to incident with status updates. 84binder_call(incidentd, incident) 85 86### 87### neverallow rules 88### 89 90# only system_server, system_app and incident command can find the incident service 91neverallow { domain -system_server -system_app -incident -incidentd } incident_service:service_manager find; 92 93# only incidentd and the other root services in limited circumstances 94# can get to the files in /data/misc/incidents 95# 96# write, execute, append are forbidden almost everywhere 97neverallow { domain -incidentd -init -vold } incident_data_file:file { 98 w_file_perms 99 x_file_perms 100 create 101 rename 102 setattr 103 unlink 104 append 105}; 106# read is also allowed by system_server, for when the file is handed to dropbox 107neverallow { domain -incidentd -init -vold -system_server } incident_data_file:file r_file_perms; 108# limited access to the directory itself 109neverallow { domain -incidentd -init -vold } incident_data_file:dir create_dir_perms; 110 111