diff --git a/private/file_contexts b/private/file_contexts
index 0bf16c8ce7b97114e76429511221ce32e14530da..8584758fe2ba0ac288534bfa9bfc4b841260aacd 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -178,6 +178,8 @@
/system/bin/surfaceflinger u:object_r:surfaceflinger_exec:s0
/system/bin/drmserver u:object_r:drmserver_exec:s0
/system/bin/dumpstate u:object_r:dumpstate_exec:s0
+/system/bin/incident u:object_r:incident_exec:s0
+/system/bin/incidentd u:object_r:incidentd_exec:s0
/system/bin/vold u:object_r:vold_exec:s0
/system/bin/netd u:object_r:netd_exec:s0
/system/bin/wificond u:object_r:wificond_exec:s0
@@ -329,6 +331,7 @@
/data/misc/dhcp(/.*)? u:object_r:dhcp_data_file:s0
/data/misc/dhcp-6.8.2(/.*)? u:object_r:dhcp_data_file:s0
/data/misc/gatekeeper(/.*)? u:object_r:gatekeeper_data_file:s0
+/data/misc/incidents(/.*)? u:object_r:incident_data_file:s0
/data/misc/keychain(/.*)? u:object_r:keychain_data_file:s0
/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0
/data/misc/logd(/.*)? u:object_r:misc_logd_file:s0
diff --git a/private/incident.te b/private/incident.te
new file mode 100644
index 0000000000000000000000000000000000000000..084bd5dfdc03f8f973a9b8ef85f45614c59f6620
--- /dev/null
+++ b/private/incident.te
@@ -0,0 +1,23 @@
+type incident_exec, exec_type, file_type;
+
+# switch to incident domain for incident command
+domain_auto_trans(shell, incident_exec, incident)
+
+# allow incident access to stdout from its parent shell.
+allow incident shell:fd use;
+
+# allow incident to communicate use, read and write over the adb
+# connection.
+allow incident adbd:fd use;
+allow incident adbd:unix_stream_socket { read write };
+
+# allow adbd to reap incident
+allow incident adbd:process { sigchld };
+
+# Allow the incident command to talk to the incidentd over the binder, and get
+# back the incident report data from a ParcelFileDescriptor.
+binder_use(incident)
+allow incident incident_service:service_manager find;
+binder_call(incident, incidentd)
+allow incident incidentd:fifo_file write;
+
diff --git a/private/incidentd.te b/private/incidentd.te
new file mode 100644
index 0000000000000000000000000000000000000000..49830f43e7b843e8043062383218b63fbc51cce1
--- /dev/null
+++ b/private/incidentd.te
@@ -0,0 +1,108 @@
+init_daemon_domain(incidentd)
+type incidentd_exec, exec_type, file_type;
+binder_use(incidentd)
+wakelock_use(incidentd)
+
+# Allow setting process priority, protect from OOM killer, and dropping
+# privileges by switching UID / GID
+# TODO allow incidentd self:capability { setuid setgid sys_resource };
+
+# Allow incidentd to scan through /proc/pid for all processes
+r_dir_file(incidentd, domain)
+
+allow incidentd self:capability {
+ # Send signals to processes
+ kill
+};
+
+# Allow executing files on system, such as:
+# /system/bin/toolbox
+# /system/bin/logcat
+# /system/bin/dumpsys
+allow incidentd system_file:file execute_no_trans;
+allow incidentd toolbox_exec:file rx_file_perms;
+
+# Create and write into /data/misc/incidents
+allow incidentd incident_data_file:dir rw_dir_perms;
+allow incidentd incident_data_file:file create_file_perms;
+
+# Get process attributes
+# TODO allow incidentd domain:process getattr;
+
+# Signal java processes to dump their stack and get the results
+# TODO allow incidentd { appdomain ephemeral_app system_server }:process signal;
+# TODO allow incidentd anr_data_file:dir rw_dir_perms;
+# TODO allow incidentd anr_data_file:file create_file_perms;
+
+# Signal native processes to dump their stack.
+# This list comes from native_processes_to_dump in incidentd/utils.c
+allow incidentd {
+ audioserver
+ cameraserver
+ drmserver
+ inputflinger
+ mediacodec
+ mediadrmserver
+ mediaextractor
+ mediaserver
+ sdcardd
+ surfaceflinger
+}:process signal;
+
+# Allow incidentd to make binder calls to any binder service
+binder_call(incidentd, binderservicedomain)
+binder_call(incidentd, appdomain)
+
+# Reading /proc/PID/maps of other processes
+# TODO allow incidentd self:capability sys_ptrace;
+
+# Run a shell.
+allow incidentd shell_exec:file rx_file_perms;
+
+# logd access - work to be done is a PII safe log (possibly an event log?)
+# TODO read_logd(incidentd)
+# TODO control_logd(incidentd)
+
+# Allow incidentd to find these standard groups of services.
+# Others can be whitelisted individually.
+allow incidentd {
+ system_server_service
+ app_api_service
+ system_api_service
+}:service_manager find;
+
+# Only incidentd can publish the binder service
+add_service(incidentd, incident_service)
+
+# Allow pipes from (and only from) incident
+allow incidentd incident:fd use;
+allow incidentd incident:fifo_file write;
+
+# Allow incident to call back to incident with status updates.
+binder_call(incidentd, incident)
+
+###
+### neverallow rules
+###
+
+# only system_server, system_app and incident command can find the incident service
+neverallow { domain -system_server -system_app -incident -incidentd } incident_service:service_manager find;
+
+# only incidentd and the other root services in limited circumstances
+# can get to the files in /data/misc/incidents
+#
+# write, execute, append are forbidden almost everywhere
+neverallow { domain -incidentd -init -vold } incident_data_file:file {
+ w_file_perms
+ x_file_perms
+ create
+ rename
+ setattr
+ unlink
+ append
+};
+# read is also allowed by system_server, for when the file is handed to dropbox
+neverallow { domain -incidentd -init -vold -system_server } incident_data_file:file r_file_perms;
+# limited access to the directory itself
+neverallow { domain -incidentd -init -vold } incident_data_file:dir create_dir_perms;
+
diff --git a/private/service_contexts b/private/service_contexts
index d53ba91ee3d177410c44d43937ea65068965fe5b..607d12b9159dde53cb657fdc68a3fe697ebc8f60 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -56,6 +56,7 @@ gpu u:object_r:gpu_service:s0
hardware u:object_r:hardware_service:s0
hardware_properties u:object_r:hardware_properties_service:s0
hdmi_control u:object_r:hdmi_control_service:s0
+incident u:object_r:incident_service:s0
inputflinger u:object_r:inputflinger_service:s0
input_method u:object_r:input_method_service:s0
input u:object_r:input_service:s0
diff --git a/private/su.te b/private/su.te
index b594ebed45dc24ed8fe62fcd29aacc8fd80672cb..466bc0bb44b9bcce6af79e45ad881212379f15fe 100644
--- a/private/su.te
+++ b/private/su.te
@@ -8,6 +8,9 @@ userdebug_or_eng(`
# from the "init" domain.
domain_auto_trans(su, dumpstate_exec, dumpstate)
+ # Put the incident command into its domain so it is the same on user, userdebug and eng.
+ domain_auto_trans(su, incident_exec, incident)
+
# su is also permissive to permit setenforce.
permissive su;
diff --git a/private/system_app.te b/private/system_app.te
index 66c1e4dd1f3cc71134f47cbcc42903af9872994a..7539da226e47cb605534d1610c206821b27975e8 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -51,6 +51,9 @@ allow system_app anr_data_file:file create_file_perms;
# Settings need to access app name and icon from asec
allow system_app asec_apk_file:file r_file_perms;
+# Allow system apps to interact with incidentd
+binder_call(system_app, incidentd)
+
allow system_app servicemanager:service_manager list;
# TODO: scope this down? Too broad?
allow system_app { service_manager_type -netd_service -dumpstate_service -installd_service }:service_manager find;
diff --git a/private/system_server.te b/private/system_server.te
index 66ea3de311c5160436a19150b07c05c2325bf85f..d0483f54da6465bfbd54f2f3e4d6178b2577d1ce 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -172,6 +172,7 @@ binder_call(system_server, fingerprintd)
binder_call(system_server, hal_fingerprint)
binder_call(system_server, gatekeeperd)
binder_call(system_server, installd)
+binder_call(system_server, incidentd)
binder_call(system_server, netd)
binder_call(system_server, wificond)
binder_service(system_server)
@@ -295,6 +296,10 @@ allow system_server asec_public_file:file create_file_perms;
allow system_server anr_data_file:dir create_dir_perms;
allow system_server anr_data_file:file create_file_perms;
+# Read /data/misc/incidents - only read. The fd will be sent over binder,
+# with no DAC access to it, for dropbox to read.
+allow system_server incident_data_file:file read;
+
# Manage /data/backup.
allow system_server backup_data_file:dir create_dir_perms;
allow system_server backup_data_file:file create_file_perms;
@@ -498,6 +503,7 @@ allow system_server dumpstate_service:service_manager find;
allow system_server fingerprintd_service:service_manager find;
allow system_server hal_fingerprint_service:service_manager find;
allow system_server gatekeeper_service:service_manager find;
+allow system_server incident_service:service_manager find;
allow system_server installd_service:service_manager find;
allow system_server keystore_service:service_manager find;
allow system_server mediaserver_service:service_manager find;
diff --git a/public/binderservicedomain.te b/public/binderservicedomain.te
index a2157a4036401f4915776ff0d2717647277476f2..0891ee5b2195f386b7493e68dd9af52570ab546b 100644
--- a/public/binderservicedomain.te
+++ b/public/binderservicedomain.te
@@ -1,9 +1,9 @@
# Rules common to all binder service domains
-# Allow dumpstate to collect information from binder services
-allow binderservicedomain dumpstate:fd use;
-allow binderservicedomain dumpstate:unix_stream_socket { read write getopt getattr };
-allow binderservicedomain dumpstate:fifo_file { getattr write };
+# Allow dumpstate and incidentd to collect information from binder services
+allow binderservicedomain { dumpstate incidentd }:fd use;
+allow binderservicedomain { dumpstate incidentd }:unix_stream_socket { read write getopt getattr };
+allow binderservicedomain { dumpstate incidentd }:fifo_file { getattr write };
allow binderservicedomain shell_data_file:file { getattr write };
# Allow dumpsys to work from adb shell or the serial console
diff --git a/public/dumpstate.te b/public/dumpstate.te
index bac648e2b581f6a76d08ea1a888a708122f9a7bb..ab23004e900bd26b65a5575e72b37999a7d273ce 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -167,7 +167,7 @@ userdebug_or_eng(`
allow dumpstate misc_logd_file:file r_file_perms;
')
-allow dumpstate { service_manager_type -gatekeeper_service -dumpstate_service }:service_manager find;
+allow dumpstate { service_manager_type -gatekeeper_service -dumpstate_service -incident_service }:service_manager find;
allow dumpstate servicemanager:service_manager list;
allow dumpstate devpts:chr_file rw_file_perms;
diff --git a/public/file.te b/public/file.te
index e562798207021561d22924f78896a5447cfe48fc..3d6b39b9d1e07b0ca1daadbe5aee98d502fc7dc7 100644
--- a/public/file.te
+++ b/public/file.te
@@ -157,6 +157,7 @@ type bootstat_data_file, file_type, data_file_type;
type boottrace_data_file, file_type, data_file_type;
type camera_data_file, file_type, data_file_type;
type gatekeeper_data_file, file_type, data_file_type;
+type incident_data_file, file_type, data_file_type;
type keychain_data_file, file_type, data_file_type;
type keystore_data_file, file_type, data_file_type;
type media_data_file, file_type, data_file_type;
diff --git a/public/incident.te b/public/incident.te
new file mode 100644
index 0000000000000000000000000000000000000000..ce57bf650869616b9345bfea957353cd5c2fe5fc
--- /dev/null
+++ b/public/incident.te
@@ -0,0 +1,8 @@
+# The incident command is used to call into the incidentd service to
+# take an incident report (binary, shared bugreport), download incident
+# reports that have already been taken, and monitor for new ones.
+# It doesn't do anything else.
+
+# incident
+type incident, domain;
+
diff --git a/public/incidentd.te b/public/incidentd.te
new file mode 100644
index 0000000000000000000000000000000000000000..b03249c88b92bdc9184e966d2b16523e1d1ff3ff
--- /dev/null
+++ b/public/incidentd.te
@@ -0,0 +1,3 @@
+# incidentd
+type incidentd, domain;
+
diff --git a/public/service.te b/public/service.te
index 097aa49a1ac4c58cbdeb7a87b93479a7e23cc747..677124820499a49ace6766e035c259a9fb495f12 100644
--- a/public/service.te
+++ b/public/service.te
@@ -10,6 +10,7 @@ type hal_fingerprint_service, service_manager_type;
type gatekeeper_service, app_api_service, service_manager_type;
type gpu_service, service_manager_type;
type inputflinger_service, service_manager_type;
+type incident_service, service_manager_type;
type installd_service, service_manager_type;
type keystore_service, service_manager_type;
type mediaserver_service, service_manager_type;
diff --git a/public/shell.te b/public/shell.te
index 9f4ac5cf5f22912b23c8e43d4c2f65af3fab2e72..73f837e0fe9f9de9865c5be694abc0a347f7f5e3 100644
--- a/public/shell.te
+++ b/public/shell.te
@@ -82,7 +82,7 @@ allow shell servicemanager:service_manager list;
# don't allow shell to access GateKeeper service
# TODO: why is this so broad? Tightening candidate? It needs at list:
# - dumpstate_service (so it can receive dumpstate progress updates)
-allow shell { service_manager_type -gatekeeper_service -netd_service -installd_service}:service_manager find;
+allow shell { service_manager_type -gatekeeper_service -incident_service -installd_service -netd_service }:service_manager find;
allow shell dumpstate:binder call;
# allow shell to get information from hwservicemanager