From 0d22c6cec62d2fa31fa013513a46440d71a65835 Mon Sep 17 00:00:00 2001
From: Mark Salyzyn <salyzyn@google.com>
Date: Tue, 26 May 2015 15:12:45 -0700
Subject: [PATCH] logd: logpersistd
- Enable logpersistd to write to /data/misc/logd
- Enable logpersistd to read from pstore to help complete any content
lost by reboot disruption
- Enable shell readonly ability logpersistd files in /data/misc/logd
- Enable logcat -f when placed into logd context to act as a
logpersistd (nee logcatd) agent, restrict access to run only in
userdebug or eng
Bug: 19608716
Change-Id: I3209582bc796a1093c325c90068a48bf268e5ab5
---
file.te | 1 +
file_contexts | 1 +
init.te | 4 ++++
logd.te | 9 +++++++++
shell.te | 3 +++
5 files changed, 18 insertions(+)
diff --git a/file.te b/file.te
index 28076f57c..0e08a38b5 100644
--- a/file.te
+++ b/file.te
@@ -165,6 +165,7 @@ type logdr_socket, file_type, mlstrustedobject;
type logdw_socket, file_type, mlstrustedobject;
type mdns_socket, file_type;
type mdnsd_socket, file_type, mlstrustedobject;
+type misc_logd_file, file_type;
type mtpd_socket, file_type;
type netd_socket, file_type;
type property_socket, file_type;
diff --git a/file_contexts b/file_contexts
index cc152f661..5ca2852de 100644
--- a/file_contexts
+++ b/file_contexts
@@ -236,6 +236,7 @@
/data/misc/gatekeeper(/.*)? u:object_r:gatekeeper_data_file:s0
/data/misc/keychain(/.*)? u:object_r:keychain_data_file:s0
/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0
+/data/misc/logd(/.*)? u:object_r:misc_logd_file:s0
/data/misc/media(/.*)? u:object_r:media_data_file:s0
/data/misc/net(/.*)? u:object_r:net_data_file:s0
/data/misc/shared_relro(/.*)? u:object_r:shared_relro_file:s0
diff --git a/init.te b/init.te
index 3af01fbee..34b010cf3 100644
--- a/init.te
+++ b/init.te
@@ -161,6 +161,10 @@ recovery_only(`
domain_trans(init, shell_exec, shell)
domain_trans(init, init_exec, ueventd)
domain_trans(init, init_exec, watchdogd)
+# case where logpersistd is actually logcat -f in logd context (nee: logcatd)
+userdebug_or_eng(`
+ domain_auto_trans(init, logcat_exec, logd)
+')
# Support "adb shell stop"
allow init self:capability kill;
diff --git a/logd.te b/logd.te
index 8c28b48a1..b0d978f3d 100644
--- a/logd.te
+++ b/logd.te
@@ -10,6 +10,10 @@ allow logd self:netlink_audit_socket { create_socket_perms nlmsg_write };
allow logd kernel:system syslog_read;
allow logd kmsg_device:chr_file w_file_perms;
allow logd system_data_file:file r_file_perms;
+allow logd misc_logd_file:file create_file_perms;
+allow logd misc_logd_file:dir rw_dir_perms;
+allow logd pstorefs:dir search;
+allow logd pstorefs:file r_file_perms;
r_dir_file(logd, domain)
@@ -17,6 +21,11 @@ allow logd kernel:system syslog_mod;
control_logd(logd)
+# case where logpersistd is actually logcat -f in logd context (nee: logcatd)
+userdebug_or_eng(`
+ unix_socket_connect(logd, logdr, logd)
+')
+
###
### Neverallow rules
###
diff --git a/shell.te b/shell.te
index c55ce3e88..ac553462a 100644
--- a/shell.te
+++ b/shell.te
@@ -15,6 +15,9 @@ control_logd(shell)
# logcat -L (directly, or via dumpstate)
allow shell pstorefs:dir search;
allow shell pstorefs:file r_file_perms;
+# logpersistd (nee logcatd) files
+allow shell misc_logd_file:dir r_dir_perms;
+allow shell misc_logd_file:file r_file_perms;
# read files in /data/anr
allow shell anr_data_file:dir r_dir_perms;
--
GitLab