From 34a468fad2c0b624b0cf383671384d0452dd83e6 Mon Sep 17 00:00:00 2001
From: Dehao Chen <dehao@google.com>
Date: Tue, 5 May 2015 15:11:44 -0700
Subject: [PATCH] Update sepolicy to add label for /data/misc/perfprofd.
Bug: 19483574
(cherry picked from commit 7d66f783c2ddea4dd5f9fcd91b2589ab74e30f8a)
Change-Id: If617e29b6fd36c88c157941bc9e11cf41329da48
---
domain.te | 1 +
file.te | 1 +
file_contexts | 1 +
perfprofd.te | 25 +++++++++++++++----------
untrusted_app.te | 7 +++++++
5 files changed, 25 insertions(+), 10 deletions(-)
diff --git a/domain.te b/domain.te
index 9614ab31c..bf3295c83 100644
--- a/domain.te
+++ b/domain.te
@@ -182,6 +182,7 @@ neverallow {
-dumpstate
-system_server
userdebug_or_eng(`-procrank')
+ userdebug_or_eng(`-perfprofd')
} self:capability sys_ptrace;
# Limit device node creation to these whitelisted domains.
diff --git a/file.te b/file.te
index e6ad9e21b..815c89216 100644
--- a/file.te
+++ b/file.te
@@ -116,6 +116,7 @@ type vpn_data_file, file_type, data_file_type;
type wifi_data_file, file_type, data_file_type;
type zoneinfo_data_file, file_type, data_file_type;
type vold_data_file, file_type, data_file_type;
+type perfprofd_data_file, file_type, data_file_type, mlstrustedobject;
# Compatibility with type names used in vanilla Android 4.3 and 4.4.
typealias audio_data_file alias audio_firmware_file;
diff --git a/file_contexts b/file_contexts
index 48fbb5a48..9575fb0ed 100644
--- a/file_contexts
+++ b/file_contexts
@@ -248,6 +248,7 @@
/data/misc/wifi/hostapd(/.*)? u:object_r:wpa_socket:s0
/data/misc/zoneinfo(/.*)? u:object_r:zoneinfo_data_file:s0
/data/misc/vold(/.*)? u:object_r:vold_data_file:s0
+/data/misc/perfprofd(/.*)? u:object_r:perfprofd_data_file:s0
/data/system/heapdump(/.*)? u:object_r:heapdump_data_file:s0
# Bootchart data
diff --git a/perfprofd.te b/perfprofd.te
index 30b438b30..c9f7f35ed 100644
--- a/perfprofd.te
+++ b/perfprofd.te
@@ -18,19 +18,13 @@ userdebug_or_eng(`
allow perfprofd system_file:file rx_file_perms;
# perfprofd reads a config file from /data/data/com.google.android.gms/files
- # opens a file for writing in the same directory
- allow perfprofd app_data_file:file rw_file_perms;
- allow perfprofd app_data_file:dir rw_dir_perms;
-
- # perfprofd looks for the existence of a semaphore file to determine
- # whether collection is enabled/disabled (where the semphore file is
- # created by some other entity, e.g. gms)
+ allow perfprofd app_data_file:file r_file_perms;
allow perfprofd app_data_file:dir search;
allow perfprofd self:capability { dac_override };
- # perfprofd reads profiles from /data/data/..., encodes them,
- # and then dumps the encoded profiles back to /data/data/....
- allow perfprofd app_data_file:dir_file_class_set create_file_perms;
+ # perfprofd opens a file for writing in /data/misc/perfprofd
+ allow perfprofd perfprofd_data_file:file create_file_perms;
+ allow perfprofd perfprofd_data_file:dir rw_dir_perms;
# perfprofd uses the system log
read_logd(perfprofd);
@@ -39,6 +33,17 @@ userdebug_or_eng(`
# simpleperf uses ioctl() to turn on kernel perf events measurements
allow perfprofd self:capability sys_admin;
+ # simpleperf needs to examine /proc to collect task/thread info
+ r_dir_file(perfprofd, domain)
+
+ # simpleperf needs to access /proc/<pid>/exec
+ allow perfprofd self:capability { sys_resource sys_ptrace };
+ neverallow perfprofd domain:process ptrace;
+
+ # simpleperf needs open/read any file that turns up in a profile
+ # to see whether it has a build ID
+ allow perfprofd exec_type:file r_file_perms;
+
# simpleperf is going to execute "sleep"
allow perfprofd toolbox_exec:file x_file_perms;
diff --git a/untrusted_app.te b/untrusted_app.te
index 215898f63..7a9e2dd3d 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -104,6 +104,13 @@ allow untrusted_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
# #define SIOCSIWCOMMIT 0x8B00 /* Commit pending changes to driver */
allow untrusted_app self:{ rawip_socket tcp_socket udp_socket } { 0x8900-0x8926 0x8928-0x89ff 0x8b00 };
+# Allow GMS core to access perfprofd output, which is stored
+# in /data/misc/perfprofd/. GMS core will need to list all
+# data stored in that directory to process them one by one.
+userdebug_or_eng(`
+ allow untrusted_app perfprofd_data_file:file r_file_perms;
+ allow untrusted_app perfprofd_data_file:dir r_dir_perms;
+')
###
### neverallow rules
###
--
GitLab