Newer
Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
type crash_dump, domain;
type crash_dump_exec, exec_type, file_type;
allow crash_dump {
domain
-init
-crash_dump
-keystore
-logd
}:process { ptrace signal sigchld sigstop sigkill };
userdebug_or_eng(`
allow crash_dump logd:process { ptrace signal sigchld sigstop sigkill };
')
# Use inherited file descriptors
allow crash_dump domain:fd use;
allow crash_dump domain:fifo_file write;
r_dir_file(crash_dump, domain)
allow crash_dump exec_type:file r_file_perms;
# Read /data/dalvik-cache.
allow crash_dump dalvikcache_data_file:dir { search getattr };
allow crash_dump dalvikcache_data_file:file r_file_perms;
# Talk to tombstoned
unix_socket_connect(crash_dump, tombstoned_crash, tombstoned)
# Talk to ActivityManager.
unix_socket_connect(crash_dump, system_ndebug, system_server)
# Append to ANR files.
allow crash_dump anr_data_file:file { append getattr };
# Append to tombstone files.
allow crash_dump tombstone_data_file:file { append getattr };
read_logd(crash_dump)
###
### neverallow assertions
###
# A domain transition must occur for crash_dump to get the privileges needed to trace the process.
# Do not allow the execution of crash_dump without a domain transition.
neverallow domain crash_dump_exec:file execute_no_trans;