diff --git a/domain.te b/domain.te index 9614ab31c7bac3c68ade2dc80891da7524e4b106..bf3295c8392c305bc29a174d27312264e1d86d4a 100644 --- a/domain.te +++ b/domain.te @@ -182,6 +182,7 @@ neverallow { -dumpstate -system_server userdebug_or_eng(`-procrank') + userdebug_or_eng(`-perfprofd') } self:capability sys_ptrace; # Limit device node creation to these whitelisted domains. diff --git a/file.te b/file.te index e6ad9e21b51b0e071c7b449df6d4a42c45e9fae7..815c892169186fd2889d2006efbb51019e6ee73d 100644 --- a/file.te +++ b/file.te @@ -116,6 +116,7 @@ type vpn_data_file, file_type, data_file_type; type wifi_data_file, file_type, data_file_type; type zoneinfo_data_file, file_type, data_file_type; type vold_data_file, file_type, data_file_type; +type perfprofd_data_file, file_type, data_file_type, mlstrustedobject; # Compatibility with type names used in vanilla Android 4.3 and 4.4. typealias audio_data_file alias audio_firmware_file; diff --git a/file_contexts b/file_contexts index 48fbb5a48a28148b87aa752f4ba648fe25ee96ef..9575fb0ed30c26a55308a6a043c8f92bc555e413 100644 --- a/file_contexts +++ b/file_contexts @@ -248,6 +248,7 @@ /data/misc/wifi/hostapd(/.*)? u:object_r:wpa_socket:s0 /data/misc/zoneinfo(/.*)? u:object_r:zoneinfo_data_file:s0 /data/misc/vold(/.*)? u:object_r:vold_data_file:s0 +/data/misc/perfprofd(/.*)? u:object_r:perfprofd_data_file:s0 /data/system/heapdump(/.*)? u:object_r:heapdump_data_file:s0 # Bootchart data diff --git a/perfprofd.te b/perfprofd.te index 30b438b307e71498e47c57a91feafc7b72c991d2..c9f7f35edcb39730358b48abfe5e0ebc63c13b61 100644 --- a/perfprofd.te +++ b/perfprofd.te @@ -18,19 +18,13 @@ userdebug_or_eng(` allow perfprofd system_file:file rx_file_perms; # perfprofd reads a config file from /data/data/com.google.android.gms/files - # opens a file for writing in the same directory - allow perfprofd app_data_file:file rw_file_perms; - allow perfprofd app_data_file:dir rw_dir_perms; - - # perfprofd looks for the existence of a semaphore file to determine - # whether collection is enabled/disabled (where the semphore file is - # created by some other entity, e.g. gms) + allow perfprofd app_data_file:file r_file_perms; allow perfprofd app_data_file:dir search; allow perfprofd self:capability { dac_override }; - # perfprofd reads profiles from /data/data/..., encodes them, - # and then dumps the encoded profiles back to /data/data/.... - allow perfprofd app_data_file:dir_file_class_set create_file_perms; + # perfprofd opens a file for writing in /data/misc/perfprofd + allow perfprofd perfprofd_data_file:file create_file_perms; + allow perfprofd perfprofd_data_file:dir rw_dir_perms; # perfprofd uses the system log read_logd(perfprofd); @@ -39,6 +33,17 @@ userdebug_or_eng(` # simpleperf uses ioctl() to turn on kernel perf events measurements allow perfprofd self:capability sys_admin; + # simpleperf needs to examine /proc to collect task/thread info + r_dir_file(perfprofd, domain) + + # simpleperf needs to access /proc/<pid>/exec + allow perfprofd self:capability { sys_resource sys_ptrace }; + neverallow perfprofd domain:process ptrace; + + # simpleperf needs open/read any file that turns up in a profile + # to see whether it has a build ID + allow perfprofd exec_type:file r_file_perms; + # simpleperf is going to execute "sleep" allow perfprofd toolbox_exec:file x_file_perms; diff --git a/untrusted_app.te b/untrusted_app.te index 215898f63e709527c25d4794fba91acdfe9db3a4..7a9e2dd3da37a800ea4850ca1d0611197051976b 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -104,6 +104,13 @@ allow untrusted_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms; # #define SIOCSIWCOMMIT 0x8B00 /* Commit pending changes to driver */ allow untrusted_app self:{ rawip_socket tcp_socket udp_socket } { 0x8900-0x8926 0x8928-0x89ff 0x8b00 }; +# Allow GMS core to access perfprofd output, which is stored +# in /data/misc/perfprofd/. GMS core will need to list all +# data stored in that directory to process them one by one. +userdebug_or_eng(` + allow untrusted_app perfprofd_data_file:file r_file_perms; + allow untrusted_app perfprofd_data_file:dir r_dir_perms; +') ### ### neverallow rules ###