Mark Salyzyn | 8ed750e | 2013-11-12 15:34:52 -0800 | [diff] [blame] | 1 | # android user-space log manager |
Stephen Smalley | 45731c7 | 2014-09-08 16:06:40 -0400 | [diff] [blame] | 2 | type logd, domain, mlstrustedsubject; |
Mark Salyzyn | 8ed750e | 2013-11-12 15:34:52 -0800 | [diff] [blame] | 3 | type logd_exec, exec_type, file_type; |
| 4 | |
| 5 | init_daemon_domain(logd) |
Mark Salyzyn | 8ed750e | 2013-11-12 15:34:52 -0800 | [diff] [blame] | 6 | |
Mark Salyzyn | 238a654 | 2014-04-01 11:02:57 -0700 | [diff] [blame] | 7 | allow logd self:capability { setuid setgid sys_nice audit_control }; |
| 8 | allow logd self:capability2 syslog; |
| 9 | allow logd self:netlink_audit_socket { create_socket_perms nlmsg_write }; |
| 10 | allow logd kernel:system syslog_read; |
Mark Salyzyn | 6252b63 | 2014-04-07 14:04:30 -0700 | [diff] [blame] | 11 | allow logd kmsg_device:chr_file w_file_perms; |
Mark Salyzyn | 61d665a | 2015-03-10 13:46:37 -0700 | [diff] [blame] | 12 | allow logd system_data_file:file r_file_perms; |
Mark Salyzyn | 7e0838a | 2015-05-26 15:12:45 -0700 | [diff] [blame] | 13 | allow logd misc_logd_file:file create_file_perms; |
| 14 | allow logd misc_logd_file:dir rw_dir_perms; |
| 15 | allow logd pstorefs:dir search; |
| 16 | allow logd pstorefs:file r_file_perms; |
Mark Salyzyn | 8ed750e | 2013-11-12 15:34:52 -0800 | [diff] [blame] | 17 | |
| 18 | r_dir_file(logd, domain) |
| 19 | |
Mark Salyzyn | 664ef57 | 2014-10-15 15:49:37 -0700 | [diff] [blame] | 20 | allow logd kernel:system syslog_mod; |
| 21 | |
Mark Salyzyn | 61d665a | 2015-03-10 13:46:37 -0700 | [diff] [blame] | 22 | control_logd(logd) |
| 23 | |
Mark Salyzyn | 7e0838a | 2015-05-26 15:12:45 -0700 | [diff] [blame] | 24 | # case where logpersistd is actually logcat -f in logd context (nee: logcatd) |
| 25 | userdebug_or_eng(` |
| 26 | unix_socket_connect(logd, logdr, logd) |
| 27 | ') |
| 28 | |
Mark Salyzyn | 8ed750e | 2013-11-12 15:34:52 -0800 | [diff] [blame] | 29 | ### |
| 30 | ### Neverallow rules |
| 31 | ### |
| 32 | ### logd should NEVER do any of this |
| 33 | |
| 34 | # Block device access. |
| 35 | neverallow logd dev_type:blk_file { read write }; |
| 36 | |
| 37 | # ptrace any other app |
| 38 | neverallow logd domain:process ptrace; |
| 39 | |
| 40 | # Write to /system. |
| 41 | neverallow logd system_file:dir_file_class_set write; |
| 42 | |
| 43 | # Write to files in /data/data or system files on /data |
| 44 | neverallow logd { app_data_file system_data_file }:dir_file_class_set write; |