diff --git a/debuggerd.te b/debuggerd.te index cf640799a1d60fa9c287bc9efe49042cd805470c..2b8d229f5f2f44aaeede5c6b29d88a314d12e831 100644 --- a/debuggerd.te +++ b/debuggerd.te @@ -31,7 +31,19 @@ allow debuggerd system_data_file:file open; # This only happens on 64 bit systems, where all requests go to the 64 bit # debuggerd and get redirected to the 32 bit debuggerd if the process is 32 bit. -allow debuggerd { audioserver cameraserver drmserver inputflinger mediacodec mediadrmserver mediaextractor mediaserver sdcardd surfaceflinger }:debuggerd dump_backtrace; +allow debuggerd { + audioserver + bluetooth + cameraserver + drmserver + inputflinger + mediacodec + mediadrmserver + mediaextractor + mediaserver + sdcardd + surfaceflinger +}:debuggerd dump_backtrace; # Connect to system_server via /data/system/ndebugsocket. unix_socket_connect(debuggerd, system_ndebug, system_server) diff --git a/dumpstate.te b/dumpstate.te index ebc0d676c33cf058f25c3b3ea3a6bff80af8ca7f..6ee8b058e048f00c6fa98eab250c611e3d3a612a 100644 --- a/dumpstate.te +++ b/dumpstate.te @@ -48,9 +48,31 @@ allow dumpstate { appdomain autoplay_app system_server }:process signal; # Signal native processes to dump their stack. # This list comes from native_processes_to_dump in dumpstate/utils.c -allow dumpstate { audioserver cameraserver drmserver inputflinger mediacodec mediadrmserver mediaextractor mediaserver sdcardd surfaceflinger }:process signal; +allow dumpstate { + audioserver + cameraserver + drmserver + inputflinger + mediacodec + mediadrmserver + mediaextractor + mediaserver + sdcardd + surfaceflinger +}:process signal; # Ask debuggerd for the backtraces of these processes. -allow dumpstate { audioserver cameraserver drmserver inputflinger mediacodec mediadrmserver mediaextractor mediaserver sdcardd surfaceflinger }:debuggerd dump_backtrace; +allow dumpstate { + audioserver + cameraserver + drmserver + inputflinger + mediacodec + mediadrmserver + mediaextractor + mediaserver + sdcardd + surfaceflinger +}:debuggerd dump_backtrace; # Execute and transition to the vdc domain domain_auto_trans(dumpstate, vdc_exec, vdc) diff --git a/system_server.te b/system_server.te index 065b6ca00b594dbeb319f3912dde2a55d43e68df..1257e51f211c34c76e64b1ab38711729b4b62825 100644 --- a/system_server.te +++ b/system_server.te @@ -147,7 +147,23 @@ binder_call(system_server, netd) binder_service(system_server) # Ask debuggerd to dump backtraces for native stacks of interest. -allow system_server { audioserver cameraserver drmserver inputflinger mediacodec mediadrmserver mediaextractor mediaserver sdcardd surfaceflinger }:debuggerd dump_backtrace; +# +# This is derived from the list that system server defines as interesting native processes +# to dump during ANRs or watchdog aborts, defined in NATIVE_STACKS_OF_INTEREST in +# frameworks/base/services/core/java/com/android/server/Watchdog.java. +allow system_server { + audioserver + bluetooth + cameraserver + drmserver + inputflinger + mediacodec + mediadrmserver + mediaextractor + mediaserver + sdcardd + surfaceflinger +}:debuggerd dump_backtrace; # Use sockets received over binder from various services. allow system_server audioserver:tcp_socket rw_socket_perms;