Allow dumpstate to run am and shell.

See http://code.google.com/p/android/issues/detail?id=65339



Further denials were observed in testing and allowed as well.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

(cherry picked from commit 208deb33)

Change-Id: I2d4135df916f67fcd3cff8c22429779ba0193b2c

dumpstate.te

@@ -73,3 +73,16 @@ allow dumpstate self:capability sys_ptrace;
 # /data/data/com.android.shell/files/bugreports/bugreport
 allow dumpstate shell_data_file:dir create_dir_perms;
 allow dumpstate shell_data_file:file create_file_perms;
+
+# Run a shell.
+allow dumpstate shell_exec:file rx_file_perms;
+
+# For running am and similar framework commands.
+# Run /system/bin/app_process.
+allow dumpstate zygote_exec:file rx_file_perms;
+# Dalvik Compiler JIT.
+allow dumpstate ashmem_device:chr_file execute;
+allow dumpstate dumpstate_tmpfs:file execute;
+allow dumpstate self:process execmem;
+# For art.
+allow dumpstate dalvikcache_data_file:file execute;

system_server.te

@@ -104,6 +104,7 @@ binder_use(system_server)
 binder_call(system_server, binderservicedomain)
 binder_call(system_server, appdomain)
 binder_call(system_server, healthd)
+binder_call(system_server, dumpstate)
 binder_service(system_server)
 
 # Read /proc/pid files for Binder clients.