From 928cf933aadcd209afc851784c91bade44afdbe1 Mon Sep 17 00:00:00 2001
From: Mark Salyzyn <salyzyn@google.com>
Date: Wed, 28 Dec 2016 08:36:55 -0800
Subject: [PATCH] logpersist: do not permit dynamic transition to domain
We allow domains to manually transition to logpersist for userdebug
or eng debug logging permissions that would be counter to monitoring
limits on a released user build.
Test: compile
Bug: 30566487
Change-Id: I03a81c75cbd2b44617e4b27c4c083a26a0e0fa87
---
public/logpersist.te | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/public/logpersist.te b/public/logpersist.te
index 7fb3ccfea..7536cb84d 100644
--- a/public/logpersist.te
+++ b/public/logpersist.te
@@ -15,6 +15,12 @@ neverallow logpersist domain:process ptrace;
# Write to files in /data/data or system files on /data except misc_logd_file
neverallow logpersist { app_data_file system_data_file }:dir_file_class_set write;
-# Only init is allowed to enter the logpersist domain via exec()
-#neverallow { domain -init } logpersist:process transition;
-#neverallow * logpersist:process dyntransition;
+# Only init should be allowed to enter the logpersist domain via exec()
+# Following is a list of debug domains we know that transition to logpersist
+# neverallow_with_undefined_domains {
+# domain
+# -init # goldfish, logcatd, raft
+# -mmi # bat, mtp8996, msmcobalt
+# -system_app # Smith.apk
+# } logpersist:process transition;
+neverallow * logpersist:process dyntransition;
--
GitLab