diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil index fe3b1dcfa56b54c4aba195f9a6a749daf224fe7c..b38eb15b238900efc373f23f28556a4404d3ecf9 100644 --- a/private/compat/26.0/26.0.ignore.cil +++ b/private/compat/26.0/26.0.ignore.cil @@ -52,6 +52,14 @@ tombstone_wifi_data_file traceur_app traceur_app_tmpfs + traced + traced_consumer_socket + traced_exec + traced_probes + traced_probes_exec + traced_probes_tmpfs + traced_producer_socket + traced_tmpfs update_engine_log_data_file vendor_init vold_prepare_subdirs diff --git a/private/domain.te b/private/domain.te index 1fd75bc78f4a90a37f7eebd6b787b08c8c0000b6..72c3855e3911b72b285934eea4dcd619a46fd0cc 100644 --- a/private/domain.te +++ b/private/domain.te @@ -71,6 +71,7 @@ full_treble_only(` -dumpstate -init userdebug_or_eng(`-perfprofd') + userdebug_or_eng(`-traced_probes') -shell userdebug_or_eng(`-traceur_app') -vendor_init diff --git a/private/ephemeral_app.te b/private/ephemeral_app.te index 7694739bdb5ec822b9e25bc7e98575b99d26435f..dbfbcf9e8531c2042233f8bc7ddb10b2b7beda3c 100644 --- a/private/ephemeral_app.te +++ b/private/ephemeral_app.te @@ -35,6 +35,12 @@ allow ephemeral_app drmserver_service:service_manager find; allow ephemeral_app radio_service:service_manager find; allow ephemeral_app ephemeral_app_api_service:service_manager find; +# Write app-specific trace data to the Perfetto traced damon. This requires +# connecting to its producer socket and obtaining a (per-process) tmpfs fd. +allow ephemeral_app traced:fd use; +allow ephemeral_app traced_tmpfs:file { read write getattr map }; +unix_socket_connect(ephemeral_app, traced_producer, traced) + ### ### neverallow rules ### diff --git a/private/file_contexts b/private/file_contexts index a678e523c3527238bc877da039c82b94e60312ac..1829b1ce0b4790dc10a7c591d454757c34d4f3c4 100644 --- a/private/file_contexts +++ b/private/file_contexts @@ -145,6 +145,8 @@ /dev/socket/tombstoned_crash u:object_r:tombstoned_crash_socket:s0 /dev/socket/tombstoned_java_trace u:object_r:tombstoned_java_trace_socket:s0 /dev/socket/tombstoned_intercept u:object_r:tombstoned_intercept_socket:s0 +/dev/socket/traced_producer u:object_r:traced_producer_socket:s0 +/dev/socket/traced_consumer u:object_r:traced_consumer_socket:s0 /dev/socket/uncrypt u:object_r:uncrypt_socket:s0 /dev/socket/webview_zygote u:object_r:webview_zygote_socket:s0 /dev/socket/wpa_eth[0-9] u:object_r:wpa_socket:s0 @@ -238,6 +240,8 @@ /system/bin/lmkd u:object_r:lmkd_exec:s0 /system/bin/inputflinger u:object_r:inputflinger_exec:s0 /system/bin/logd u:object_r:logd_exec:s0 +/system/bin/traced u:object_r:traced_exec:s0 +/system/bin/traced_probes u:object_r:traced_probes_exec:s0 /system/bin/uncrypt u:object_r:uncrypt_exec:s0 /system/bin/update_verifier u:object_r:update_verifier_exec:s0 /system/bin/logwrapper u:object_r:system_file:s0 diff --git a/private/isolated_app.te b/private/isolated_app.te index 30253af60be10eecd8ba1fcac0e2448b9ddbb9ac..06ed2c82cf4e71ccc3c7b4b80ace561c2835cc21 100644 --- a/private/isolated_app.te +++ b/private/isolated_app.te @@ -47,6 +47,12 @@ allow isolated_app webview_zygote_tmpfs:file read; # suppress denials to /data/local/tmp dontaudit isolated_app shell_data_file:dir search; +# Write app-specific trace data to the Perfetto traced damon. This requires +# connecting to its producer socket and obtaining a (per-process) tmpfs fd. +allow isolated_app traced:fd use; +allow isolated_app traced_tmpfs:file { read write getattr map }; +unix_socket_connect(isolated_app, traced_producer, traced) + ##### ##### Neverallow ##### diff --git a/private/priv_app.te b/private/priv_app.te index ea1ce5b1668e525703535f17c4649fd1ab3afa10..92bfc570aa5e1f297068ace3ec03d772c1333947 100644 --- a/private/priv_app.te +++ b/private/priv_app.te @@ -116,6 +116,12 @@ allow priv_app selinuxfs:file r_file_perms; read_runtime_log_tags(priv_app) +# Write app-specific trace data to the Perfetto traced damon. This requires +# connecting to its producer socket and obtaining a (per-process) tmpfs fd. +allow priv_app traced:fd use; +allow priv_app traced_tmpfs:file { read write getattr map }; +unix_socket_connect(priv_app, traced_producer, traced) + # suppress denials when safetynet scans /system dontaudit priv_app exec_type:file getattr; dontaudit priv_app device:dir read; diff --git a/private/shell.te b/private/shell.te index 5299532ac64e15c88232b8a37da11609c585d578..a3c49db3708d7467b09d3c572b77e4543ab6dbc2 100644 --- a/private/shell.te +++ b/private/shell.te @@ -26,3 +26,13 @@ binder_call(shell, storaged) # Perform SELinux access checks, needed for CTS selinux_check_access(shell) selinux_check_context(shell) + +# Control Perfetto traced and obtain traces from it. +# Needed for Studio and debugging. +unix_socket_connect(shell, traced_consumer, traced) + +# Allow shell binaries to write trace data to Perfetto. Used for testing and +# cmdline utils. +allow shell traced:fd use; +allow shell traced_tmpfs:file { read write getattr map }; +unix_socket_connect(shell, traced_producer, traced) diff --git a/private/statsd.te b/private/statsd.te index 9d78ebb40c3b885d588cb699f2e143461a81451d..6b7f8cdd7bf3300b8594cb2358dc1b1071f16f42 100644 --- a/private/statsd.te +++ b/private/statsd.te @@ -30,6 +30,9 @@ binder_call(statsd, statscompanion_service) read_logd(statsd) control_logd(statsd) +# Allow to control Perfetto traced and consume its traces. +unix_socket_connect(statsd, traced_consumer, traced) + # Grant statsd with permissions to register the services. allow statsd { statscompanion_service @@ -71,4 +74,3 @@ neverallow { domain -statsd -init -vold -vendor_init } stats_data_file:file *; # Limited access to the directory itself. neverallow { domain -statsd -init -vold -vendor_init } stats_data_file:dir *; - diff --git a/private/traced.te b/private/traced.te new file mode 100644 index 0000000000000000000000000000000000000000..bb7a09191b5316c223f81da7a60678eb0e101d12 --- /dev/null +++ b/private/traced.te @@ -0,0 +1,38 @@ +# Perfetto user-space tracing daemon (unprivileged) +type traced, domain, coredomain; +type traced_exec, exec_type, file_type; + +# Allow init to exec the daemon. +init_daemon_domain(traced) + +# Allow traced to start with a lower scheduling class and change +# class accordingly to what defined in the config provided by +# the privileged process that controls it. +allow traced self:global_capability_class_set { sys_nice }; + +### +### Neverallow rules +### +### traced should NEVER do any of this + +# Disallow mapping executable memory (execstack and exec are already disallowed +# globally in domain.te). +neverallow traced self:process execmem; + +# Block device access. +neverallow traced dev_type:blk_file { read write }; + +# ptrace any other process +neverallow traced domain:process ptrace; + +# Disallows access to /data files, still allowing to write to file descriptors +# passed through the socket. +neverallow traced { data_file_type -system_data_file -zoneinfo_data_file }:dir *; +neverallow traced system_data_file:dir ~{ getattr search }; +neverallow traced zoneinfo_data_file:dir ~r_dir_perms; +neverallow traced { data_file_type -zoneinfo_data_file }:lnk_file *; +neverallow traced { data_file_type -zoneinfo_data_file }:file ~write; + +# Only init is allowed to enter the traced domain via exec() +neverallow { domain -init } traced:process transition; +neverallow * traced:process dyntransition; diff --git a/private/traced_probes.te b/private/traced_probes.te new file mode 100644 index 0000000000000000000000000000000000000000..15c51d4cd8561d64cc55fa7cb4002f9740d37abf --- /dev/null +++ b/private/traced_probes.te @@ -0,0 +1,55 @@ +# Perfetto tracing probes, has tracefs access. +type traced_probes, domain, coredomain; +type traced_probes_exec, exec_type, file_type; + +# Allow init to exec the daemon. +init_daemon_domain(traced_probes) + +# Write trace data to the Perfetto traced damon. This requires connecting to its +# producer socket and obtaining a (per-process) tmpfs fd. +allow traced_probes traced:fd use; +allow traced_probes traced_tmpfs:file { read write getattr map }; +unix_socket_connect(traced_probes, traced_producer, traced) + +# Allow traced_probes to access tracefs. +# TODO(primiano): For the moment this is userdebug/eng only until we get an +# approval for user builds. +userdebug_or_eng(` +allow traced_probes debugfs_tracing:dir r_dir_perms; +allow traced_probes debugfs_tracing:file rw_file_perms; +allow traced_probes debugfs_tracing_debug:file rw_file_perms; +allow traced_probes debugfs_trace_marker:file getattr; +') + +# Allow traced_probes to start with a higher scheduling class and then downgrade +# itself. +allow traced_probes self:global_capability_class_set { sys_nice }; + +# Allow procfs access +r_dir_file(traced_probes, domain) + +### +### Neverallow rules +### +### traced_probes should NEVER do any of this + +# Disallow mapping executable memory (execstack and exec are already disallowed +# globally in domain.te). +neverallow traced_probes self:process execmem; + +# Block device access. +neverallow traced_probes dev_type:blk_file { read write }; + +# ptrace any other app +neverallow traced_probes domain:process ptrace; + +# Disallows access to /data files. +neverallow traced { data_file_type -system_data_file -zoneinfo_data_file }:dir *; +neverallow traced system_data_file:dir ~{ getattr search }; +neverallow traced zoneinfo_data_file:dir ~r_dir_perms; +neverallow traced { data_file_type -zoneinfo_data_file }:lnk_file *; +neverallow traced { data_file_type -zoneinfo_data_file }:file *; + +# Only init is allowed to enter the traced_probes domain via exec() +neverallow { domain -init } traced_probes:process transition; +neverallow * traced_probes:process dyntransition; diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te index f96cae0e1d2d12d51b3c0c83af3bac27d2c7db1f..e76407bc0b2fd8b2c0a05c4df1552c4ab92d7ded 100644 --- a/private/untrusted_app_all.te +++ b/private/untrusted_app_all.te @@ -105,3 +105,9 @@ allow untrusted_app_all preloads_data_file:dir search; allow untrusted_app_all vendor_app_file:dir { open getattr read search }; allow untrusted_app_all vendor_app_file:file { open getattr read execute }; allow untrusted_app_all vendor_app_file:lnk_file { open getattr read }; + +# Write app-specific trace data to the Perfetto traced damon. This requires +# connecting to its producer socket and obtaining a (per-process) tmpfs fd. +allow untrusted_app_all traced:fd use; +allow untrusted_app_all traced_tmpfs:file { read write getattr map }; +unix_socket_connect(untrusted_app_all, traced_producer, traced) diff --git a/private/untrusted_v2_app.te b/private/untrusted_v2_app.te index 60634aefb155068c668bc26160fecc763cd65f80..8f4bceb2c61575087a4f35741c3e536c77720226 100644 --- a/private/untrusted_v2_app.te +++ b/private/untrusted_v2_app.te @@ -39,3 +39,9 @@ allow untrusted_v2_app app_api_service:service_manager find; # gdbserver for ndk-gdb ptrace attaches to app process. allow untrusted_v2_app self:process ptrace; + +# Write app-specific trace data to the Perfetto traced damon. This requires +# connecting to its producer socket and obtaining a (per-process) tmpfs fd. +allow untrusted_v2_app traced:fd use; +allow untrusted_v2_app traced_tmpfs:file { read write getattr map }; +unix_socket_connect(untrusted_v2_app, traced_producer, traced) diff --git a/public/domain.te b/public/domain.te index 142c10b202c5822f06d7bb9492189d74e07a018a..70d8ae20fd3c551c54026ef63de7e5a7120108fa 100644 --- a/public/domain.te +++ b/public/domain.te @@ -149,7 +149,8 @@ allow domain sysfs:lnk_file { getattr read }; # libc references /data/misc/zoneinfo for timezone related information # This directory is considered to be a VNDK-stable -r_dir_file(domain, zoneinfo_data_file) +allow domain zoneinfo_data_file:file r_file_perms; +allow domain zoneinfo_data_file:dir r_dir_perms; # Lots of processes access current CPU information r_dir_file(domain, sysfs_devices_system_cpu) diff --git a/public/file.te b/public/file.te index 9856f7716335da693cb21652a91f85a34a85550f..e8e87b88def1c8811e220853454a256f7fc8aa86 100644 --- a/public/file.te +++ b/public/file.te @@ -315,6 +315,8 @@ type system_ndebug_socket, file_type, data_file_type, core_data_file_type, cored type tombstoned_crash_socket, file_type, coredomain_socket, mlstrustedobject; type tombstoned_java_trace_socket, file_type, mlstrustedobject; type tombstoned_intercept_socket, file_type, coredomain_socket; +type traced_producer_socket, file_type, coredomain_socket; +type traced_consumer_socket, file_type, coredomain_socket; type uncrypt_socket, file_type, coredomain_socket; type webview_zygote_socket, file_type, coredomain_socket; type wpa_socket, file_type, data_file_type;