Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 1 | # dumpstate |
| 2 | type dumpstate, domain; |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 3 | type dumpstate_exec, exec_type, file_type; |
| 4 | |
| 5 | init_daemon_domain(dumpstate) |
| 6 | net_domain(dumpstate) |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 7 | binder_use(dumpstate) |
| 8 | |
| 9 | # Drop privileges by switching UID / GID |
| 10 | allow dumpstate self:capability { setuid setgid }; |
| 11 | |
| 12 | # Allow dumpstate to scan through /proc/pid for all processes |
| 13 | r_dir_file(dumpstate, domain) |
| 14 | |
| 15 | # Send signals to processes |
| 16 | allow dumpstate self:capability kill; |
| 17 | |
| 18 | # Allow executing files on system, such as: |
| 19 | # /system/bin/toolbox |
| 20 | # /system/bin/logcat |
| 21 | # /system/bin/dumpsys |
| 22 | allow dumpstate system_file:file execute_no_trans; |
| 23 | |
| 24 | # Create and write into /data/anr/ |
| 25 | allow dumpstate self:capability { dac_override chown fowner fsetid }; |
| 26 | allow dumpstate anr_data_file:dir { rw_dir_perms relabelto }; |
| 27 | allow dumpstate anr_data_file:file create_file_perms; |
| 28 | allow dumpstate system_data_file:dir { create_dir_perms relabelfrom }; |
| 29 | |
| 30 | # Allow reading /data/system/uiderrors.txt |
| 31 | # TODO: scope this down. |
| 32 | allow dumpstate system_data_file:file r_file_perms; |
| 33 | |
| 34 | # Read dmesg |
| 35 | allow dumpstate self:capability2 syslog; |
| 36 | allow dumpstate kernel:system syslog_read; |
| 37 | |
Nick Kralevich | a8281ad | 2014-06-09 13:19:36 -0700 | [diff] [blame] | 38 | # Read /sys/fs/pstore/console-ramoops |
| 39 | allow dumpstate pstorefs:dir r_dir_perms; |
| 40 | allow dumpstate pstorefs:file r_file_perms; |
| 41 | |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 42 | # Get process attributes |
| 43 | allow dumpstate domain:process getattr; |
| 44 | |
| 45 | # Signal java processes to dump their stack |
| 46 | allow dumpstate { appdomain system_server }:process signal; |
| 47 | |
| 48 | # Signal native processes to dump their stack. |
| 49 | # This list comes from native_processes_to_dump in dumpstate/utils.c |
| 50 | allow dumpstate { drmserver mediaserver sdcardd surfaceflinger }:process signal; |
| 51 | |
Nick Kralevich | c0d1476 | 2014-06-25 12:30:11 -0700 | [diff] [blame] | 52 | # Execute and transition to the vdc domain |
| 53 | domain_auto_trans(dumpstate, vdc_exec, vdc) |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 54 | |
| 55 | # Vibrate the device after we're done collecting the bugreport |
| 56 | # /sys/class/timed_output/vibrator/enable |
| 57 | # TODO: create a new file class, instead of allowing write access to all of /sys |
| 58 | allow dumpstate sysfs:file w_file_perms; |
| 59 | |
| 60 | # Other random bits of data we want to collect |
| 61 | allow dumpstate qtaguid_proc:file r_file_perms; |
| 62 | allow dumpstate debugfs:file r_file_perms; |
| 63 | |
| 64 | # Allow dumpstate to make binder calls to any binder service |
| 65 | binder_call(dumpstate, binderservicedomain) |
| 66 | binder_call(dumpstate, appdomain) |
| 67 | |
| 68 | # Reading /proc/PID/maps of other processes |
| 69 | allow dumpstate self:capability sys_ptrace; |
Nick Kralevich | bfa3cd5 | 2014-01-05 19:20:10 -0800 | [diff] [blame] | 70 | |
| 71 | # Allow the bugreport service to create a file in |
| 72 | # /data/data/com.android.shell/files/bugreports/bugreport |
Stephen Smalley | a506613 | 2014-01-07 13:25:25 -0500 | [diff] [blame] | 73 | allow dumpstate shell_data_file:dir create_dir_perms; |
Nick Kralevich | bfa3cd5 | 2014-01-05 19:20:10 -0800 | [diff] [blame] | 74 | allow dumpstate shell_data_file:file create_file_perms; |
Stephen Smalley | 208deb3 | 2014-01-29 14:56:41 -0500 | [diff] [blame] | 75 | |
| 76 | # Run a shell. |
| 77 | allow dumpstate shell_exec:file rx_file_perms; |
| 78 | |
| 79 | # For running am and similar framework commands. |
| 80 | # Run /system/bin/app_process. |
| 81 | allow dumpstate zygote_exec:file rx_file_perms; |
| 82 | # Dalvik Compiler JIT. |
| 83 | allow dumpstate ashmem_device:chr_file execute; |
| 84 | allow dumpstate dumpstate_tmpfs:file execute; |
| 85 | allow dumpstate self:process execmem; |
| 86 | # For art. |
| 87 | allow dumpstate dalvikcache_data_file:file execute; |
Mark Salyzyn | 8ed750e | 2013-11-12 15:34:52 -0800 | [diff] [blame] | 88 | |
Nick Kralevich | b2ed044 | 2014-06-09 12:51:42 -0700 | [diff] [blame] | 89 | # Dumpstate calls screencap, which grabs a screenshot. Needs gpu access |
| 90 | allow dumpstate gpu_device:chr_file rw_file_perms; |
| 91 | |
Mark Salyzyn | 8ed750e | 2013-11-12 15:34:52 -0800 | [diff] [blame] | 92 | # logd access |
| 93 | read_logd(dumpstate) |
| 94 | control_logd(dumpstate) |
Sreeram Ramachandran | d2d172a | 2014-07-08 15:46:52 -0700 | [diff] [blame] | 95 | |
| 96 | # Read network state info files. |
| 97 | allow dumpstate net_data_file:dir search; |
| 98 | allow dumpstate net_data_file:file r_file_perms; |
Christopher Ferris | 12b8f79 | 2014-07-22 18:39:04 -0700 | [diff] [blame] | 99 | |
| 100 | # Access /data/tombstones. |
| 101 | allow dumpstate tombstone_data_file:dir r_dir_perms; |
| 102 | allow dumpstate tombstone_data_file:file r_file_perms; |
Christopher Ferris | 04f3d79 | 2014-09-12 21:59:05 -0700 | [diff] [blame] | 103 | |
| 104 | # Access /system/bin executables to determine type of executable. |
| 105 | allow dumpstate {drmserver_exec mediaserver_exec sdcardd_exec surfaceflinger_exec}:file r_file_perms; |