Skip to content
Snippets Groups Projects
  • Christian Poetzsch's avatar
    4dafa72a
    sepolicy: add support for new tracefs · 4dafa72a
    Christian Poetzsch authored
    Since kernel 4.1 ftrace is supported as a new separate filesystem. It
    gets automatically mounted by the kernel under the old path
    /sys/kernel/debug/tracing. Because it lives now on a separate device
    some sepolicy rules need to be updated. This patch is doing that. Most
    of the rules are created based on a conversation happened on the SELinux
    Android mailing list:
    
    http://comments.gmane.org/gmane.comp.security.seandroid/2799
    
    
    
    Note, that this also needs 3a343a1 from the 4.4 branch in kernel/common.
    Also note that when tracefs is auto mounted by the kernel, the kernel
    does not use the "mode" parameter specified to mount debugfs for
    tracefs. So an extra line like
    
       chmod 0755 /sys/kernel/debug/tracing
    
    is necessary in init.${ro.hardware}.rc after debugfs was mounted.
    
    Change-Id: I60fb7a90e24628e0370c3bca57644451fce5646d
    Signed-off-by: default avatarChristian Poetzsch <christian.potzsch@imgtec.com>
    4dafa72a
    History
    sepolicy: add support for new tracefs
    Christian Poetzsch authored
    Since kernel 4.1 ftrace is supported as a new separate filesystem. It
    gets automatically mounted by the kernel under the old path
    /sys/kernel/debug/tracing. Because it lives now on a separate device
    some sepolicy rules need to be updated. This patch is doing that. Most
    of the rules are created based on a conversation happened on the SELinux
    Android mailing list:
    
    http://comments.gmane.org/gmane.comp.security.seandroid/2799
    
    
    
    Note, that this also needs 3a343a1 from the 4.4 branch in kernel/common.
    Also note that when tracefs is auto mounted by the kernel, the kernel
    does not use the "mode" parameter specified to mount debugfs for
    tracefs. So an extra line like
    
       chmod 0755 /sys/kernel/debug/tracing
    
    is necessary in init.${ro.hardware}.rc after debugfs was mounted.
    
    Change-Id: I60fb7a90e24628e0370c3bca57644451fce5646d
    Signed-off-by: default avatarChristian Poetzsch <christian.potzsch@imgtec.com>