Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 1 | # dumpstate |
Stephen Smalley | cbc5279 | 2014-09-11 15:51:28 -0400 | [diff] [blame] | 2 | type dumpstate, domain, mlstrustedsubject; |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 3 | type dumpstate_exec, exec_type, file_type; |
| 4 | |
| 5 | init_daemon_domain(dumpstate) |
| 6 | net_domain(dumpstate) |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 7 | binder_use(dumpstate) |
| 8 | |
Christopher Ferris | 5ec38c4 | 2015-01-29 12:11:55 -0800 | [diff] [blame] | 9 | # Allow setting process priority, protect from OOM killer, and dropping |
| 10 | # privileges by switching UID / GID |
| 11 | allow dumpstate self:capability { setuid setgid sys_resource }; |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 12 | |
| 13 | # Allow dumpstate to scan through /proc/pid for all processes |
| 14 | r_dir_file(dumpstate, domain) |
| 15 | |
| 16 | # Send signals to processes |
| 17 | allow dumpstate self:capability kill; |
| 18 | |
| 19 | # Allow executing files on system, such as: |
| 20 | # /system/bin/toolbox |
| 21 | # /system/bin/logcat |
| 22 | # /system/bin/dumpsys |
| 23 | allow dumpstate system_file:file execute_no_trans; |
| 24 | |
| 25 | # Create and write into /data/anr/ |
| 26 | allow dumpstate self:capability { dac_override chown fowner fsetid }; |
| 27 | allow dumpstate anr_data_file:dir { rw_dir_perms relabelto }; |
| 28 | allow dumpstate anr_data_file:file create_file_perms; |
| 29 | allow dumpstate system_data_file:dir { create_dir_perms relabelfrom }; |
| 30 | |
| 31 | # Allow reading /data/system/uiderrors.txt |
| 32 | # TODO: scope this down. |
| 33 | allow dumpstate system_data_file:file r_file_perms; |
| 34 | |
| 35 | # Read dmesg |
| 36 | allow dumpstate self:capability2 syslog; |
| 37 | allow dumpstate kernel:system syslog_read; |
| 38 | |
Nick Kralevich | a8281ad | 2014-06-09 13:19:36 -0700 | [diff] [blame] | 39 | # Read /sys/fs/pstore/console-ramoops |
| 40 | allow dumpstate pstorefs:dir r_dir_perms; |
| 41 | allow dumpstate pstorefs:file r_file_perms; |
| 42 | |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 43 | # Get process attributes |
| 44 | allow dumpstate domain:process getattr; |
| 45 | |
| 46 | # Signal java processes to dump their stack |
| 47 | allow dumpstate { appdomain system_server }:process signal; |
| 48 | |
| 49 | # Signal native processes to dump their stack. |
| 50 | # This list comes from native_processes_to_dump in dumpstate/utils.c |
| 51 | allow dumpstate { drmserver mediaserver sdcardd surfaceflinger }:process signal; |
Stephen Smalley | 77a236c | 2014-08-01 10:15:24 -0400 | [diff] [blame] | 52 | # Ask debuggerd for the backtraces of these processes. |
| 53 | allow dumpstate { drmserver mediaserver sdcardd surfaceflinger }:debuggerd dump_backtrace; |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 54 | |
Nick Kralevich | c0d1476 | 2014-06-25 12:30:11 -0700 | [diff] [blame] | 55 | # Execute and transition to the vdc domain |
| 56 | domain_auto_trans(dumpstate, vdc_exec, vdc) |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 57 | |
| 58 | # Vibrate the device after we're done collecting the bugreport |
| 59 | # /sys/class/timed_output/vibrator/enable |
| 60 | # TODO: create a new file class, instead of allowing write access to all of /sys |
| 61 | allow dumpstate sysfs:file w_file_perms; |
| 62 | |
| 63 | # Other random bits of data we want to collect |
| 64 | allow dumpstate qtaguid_proc:file r_file_perms; |
| 65 | allow dumpstate debugfs:file r_file_perms; |
Nick Kralevich | c24d90c | 2015-04-06 15:24:51 -0700 | [diff] [blame] | 66 | # df for /storage/emulated needs search |
| 67 | allow dumpstate storage_file:dir search; |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 68 | |
| 69 | # Allow dumpstate to make binder calls to any binder service |
| 70 | binder_call(dumpstate, binderservicedomain) |
| 71 | binder_call(dumpstate, appdomain) |
| 72 | |
| 73 | # Reading /proc/PID/maps of other processes |
| 74 | allow dumpstate self:capability sys_ptrace; |
Nick Kralevich | bfa3cd5 | 2014-01-05 19:20:10 -0800 | [diff] [blame] | 75 | |
| 76 | # Allow the bugreport service to create a file in |
| 77 | # /data/data/com.android.shell/files/bugreports/bugreport |
Stephen Smalley | a506613 | 2014-01-07 13:25:25 -0500 | [diff] [blame] | 78 | allow dumpstate shell_data_file:dir create_dir_perms; |
Nick Kralevich | bfa3cd5 | 2014-01-05 19:20:10 -0800 | [diff] [blame] | 79 | allow dumpstate shell_data_file:file create_file_perms; |
Stephen Smalley | 208deb3 | 2014-01-29 14:56:41 -0500 | [diff] [blame] | 80 | |
| 81 | # Run a shell. |
| 82 | allow dumpstate shell_exec:file rx_file_perms; |
| 83 | |
| 84 | # For running am and similar framework commands. |
| 85 | # Run /system/bin/app_process. |
| 86 | allow dumpstate zygote_exec:file rx_file_perms; |
| 87 | # Dalvik Compiler JIT. |
| 88 | allow dumpstate ashmem_device:chr_file execute; |
| 89 | allow dumpstate dumpstate_tmpfs:file execute; |
| 90 | allow dumpstate self:process execmem; |
| 91 | # For art. |
| 92 | allow dumpstate dalvikcache_data_file:file execute; |
Kazuki Nakayama | 9103c97 | 2015-03-23 16:31:13 +0900 | [diff] [blame] | 93 | allow dumpstate dalvikcache_data_file:lnk_file r_file_perms; |
Mark Salyzyn | 8ed750e | 2013-11-12 15:34:52 -0800 | [diff] [blame] | 94 | |
Nick Kralevich | b2ed044 | 2014-06-09 12:51:42 -0700 | [diff] [blame] | 95 | # Dumpstate calls screencap, which grabs a screenshot. Needs gpu access |
| 96 | allow dumpstate gpu_device:chr_file rw_file_perms; |
| 97 | |
Mark Salyzyn | 8ed750e | 2013-11-12 15:34:52 -0800 | [diff] [blame] | 98 | # logd access |
| 99 | read_logd(dumpstate) |
| 100 | control_logd(dumpstate) |
Sreeram Ramachandran | d2d172a | 2014-07-08 15:46:52 -0700 | [diff] [blame] | 101 | |
| 102 | # Read network state info files. |
| 103 | allow dumpstate net_data_file:dir search; |
| 104 | allow dumpstate net_data_file:file r_file_perms; |
Riley Spahn | 603bc20 | 2014-07-18 09:24:13 -0700 | [diff] [blame] | 105 | |
Christopher Ferris | b2eaa28 | 2014-07-22 18:39:04 -0700 | [diff] [blame] | 106 | # Access /data/tombstones. |
| 107 | allow dumpstate tombstone_data_file:dir r_dir_perms; |
| 108 | allow dumpstate tombstone_data_file:file r_file_perms; |
| 109 | |
Andres Morales | e207986 | 2015-04-03 16:46:33 -0700 | [diff] [blame] | 110 | allow dumpstate { service_manager_type -gatekeeper_service }:service_manager find; |
dcashman | 0780f30 | 2014-12-30 15:21:50 -0800 | [diff] [blame] | 111 | allow dumpstate servicemanager:service_manager list; |
Christopher Ferris | 5ec38c4 | 2015-01-29 12:11:55 -0800 | [diff] [blame] | 112 | |
| 113 | allow dumpstate devpts:chr_file rw_file_perms; |