From 7d66f783c2ddea4dd5f9fcd91b2589ab74e30f8a Mon Sep 17 00:00:00 2001
From: Dehao Chen <dehao@google.com>
Date: Tue, 5 May 2015 15:11:44 -0700
Subject: [PATCH] Update sepolicy to add label for /data/misc/perfprofd.
Bug: 19483574
Change-Id: I7e4c0cf748d2b216dcb3aede3803883552b58b64
---
domain.te | 1 +
file.te | 1 +
file_contexts | 1 +
perfprofd.te | 25 +++++++++++++++----------
untrusted_app.te | 7 +++++++
5 files changed, 25 insertions(+), 10 deletions(-)
diff --git a/domain.te b/domain.te
index 4d115fd29..60f2baae1 100644
--- a/domain.te
+++ b/domain.te
@@ -183,6 +183,7 @@ neverallow {
-dumpstate
-system_server
userdebug_or_eng(`-procrank')
+ userdebug_or_eng(`-perfprofd')
} self:capability sys_ptrace;
# Limit device node creation to these whitelisted domains.
diff --git a/file.te b/file.te
index 7bd38434a..28076f57c 100644
--- a/file.te
+++ b/file.te
@@ -116,6 +116,7 @@ type vpn_data_file, file_type, data_file_type;
type wifi_data_file, file_type, data_file_type;
type zoneinfo_data_file, file_type, data_file_type;
type vold_data_file, file_type, data_file_type;
+type perfprofd_data_file, file_type, data_file_type, mlstrustedobject;
# Compatibility with type names used in vanilla Android 4.3 and 4.4.
typealias audio_data_file alias audio_firmware_file;
diff --git a/file_contexts b/file_contexts
index e4b6b157e..f7a2c3593 100644
--- a/file_contexts
+++ b/file_contexts
@@ -247,6 +247,7 @@
/data/misc/wifi/hostapd(/.*)? u:object_r:wpa_socket:s0
/data/misc/zoneinfo(/.*)? u:object_r:zoneinfo_data_file:s0
/data/misc/vold(/.*)? u:object_r:vold_data_file:s0
+/data/misc/perfprofd(/.*)? u:object_r:perfprofd_data_file:s0
/data/system/heapdump(/.*)? u:object_r:heapdump_data_file:s0
# Bootchart data
diff --git a/perfprofd.te b/perfprofd.te
index 30b438b30..c9f7f35ed 100644
--- a/perfprofd.te
+++ b/perfprofd.te
@@ -18,19 +18,13 @@ userdebug_or_eng(`
allow perfprofd system_file:file rx_file_perms;
# perfprofd reads a config file from /data/data/com.google.android.gms/files
- # opens a file for writing in the same directory
- allow perfprofd app_data_file:file rw_file_perms;
- allow perfprofd app_data_file:dir rw_dir_perms;
-
- # perfprofd looks for the existence of a semaphore file to determine
- # whether collection is enabled/disabled (where the semphore file is
- # created by some other entity, e.g. gms)
+ allow perfprofd app_data_file:file r_file_perms;
allow perfprofd app_data_file:dir search;
allow perfprofd self:capability { dac_override };
- # perfprofd reads profiles from /data/data/..., encodes them,
- # and then dumps the encoded profiles back to /data/data/....
- allow perfprofd app_data_file:dir_file_class_set create_file_perms;
+ # perfprofd opens a file for writing in /data/misc/perfprofd
+ allow perfprofd perfprofd_data_file:file create_file_perms;
+ allow perfprofd perfprofd_data_file:dir rw_dir_perms;
# perfprofd uses the system log
read_logd(perfprofd);
@@ -39,6 +33,17 @@ userdebug_or_eng(`
# simpleperf uses ioctl() to turn on kernel perf events measurements
allow perfprofd self:capability sys_admin;
+ # simpleperf needs to examine /proc to collect task/thread info
+ r_dir_file(perfprofd, domain)
+
+ # simpleperf needs to access /proc/<pid>/exec
+ allow perfprofd self:capability { sys_resource sys_ptrace };
+ neverallow perfprofd domain:process ptrace;
+
+ # simpleperf needs open/read any file that turns up in a profile
+ # to see whether it has a build ID
+ allow perfprofd exec_type:file r_file_perms;
+
# simpleperf is going to execute "sleep"
allow perfprofd toolbox_exec:file x_file_perms;
diff --git a/untrusted_app.te b/untrusted_app.te
index 5ad8c79bd..72d0a1bbf 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -93,6 +93,13 @@ allow untrusted_app persistent_data_block_service:service_manager find;
allow untrusted_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms;
allow untrusted_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
+# Allow GMS core to access perfprofd output, which is stored
+# in /data/misc/perfprofd/. GMS core will need to list all
+# data stored in that directory to process them one by one.
+userdebug_or_eng(`
+ allow untrusted_app perfprofd_data_file:file r_file_perms;
+ allow untrusted_app perfprofd_data_file:dir r_dir_perms;
+')
###
### neverallow rules
###
--
GitLab