Skip to content
Snippets Groups Projects
Commit 955e543a authored by yro's avatar yro Committed by android-build-merger
Browse files

Update statsd sepolicies to avoid selinux violations during cts tests and pulling metrics

am: e27af27f

Change-Id: I40b4e204ec7d58c7d6971cf7e5e502e10011737a
parents 3ed0362a e27af27f
No related branches found
No related tags found
No related merge requests found
...@@ -13,10 +13,15 @@ r_dir_file(statsd, domain) ...@@ -13,10 +13,15 @@ r_dir_file(statsd, domain)
# /system/bin/toolbox # /system/bin/toolbox
# /system/bin/logcat # /system/bin/logcat
# /system/bin/dumpsys # /system/bin/dumpsys
allow statsd devpts:chr_file { getattr ioctl read write };
allow statsd shell_exec:file rx_file_perms; allow statsd shell_exec:file rx_file_perms;
allow statsd system_file:file execute_no_trans; allow statsd system_file:file execute_no_trans;
allow statsd toolbox_exec:file rx_file_perms; allow statsd toolbox_exec:file rx_file_perms;
userdebug_or_eng(`
allow statsd su:fifo_file read;
')
# Create, read, and write into /data/misc/stats-data, /data/misc/stats-system. # Create, read, and write into /data/misc/stats-data, /data/misc/stats-system.
allow statsd stats_data_file:dir create_dir_perms; allow statsd stats_data_file:dir create_dir_perms;
allow statsd stats_data_file:file create_file_perms; allow statsd stats_data_file:file create_file_perms;
...@@ -25,6 +30,7 @@ allow statsd stats_data_file:file create_file_perms; ...@@ -25,6 +30,7 @@ allow statsd stats_data_file:file create_file_perms;
binder_call(statsd, appdomain) binder_call(statsd, appdomain)
binder_call(statsd, incidentd) binder_call(statsd, incidentd)
binder_call(statsd, statscompanion_service) binder_call(statsd, statscompanion_service)
binder_call(statsd, system_server)
# Allow logd access. # Allow logd access.
read_logd(statsd) read_logd(statsd)
...@@ -50,6 +56,10 @@ allow statsd stats:fifo_file write; ...@@ -50,6 +56,10 @@ allow statsd stats:fifo_file write;
# Allow statsd to call back to stats with status updates. # Allow statsd to call back to stats with status updates.
binder_call(statsd, stats) binder_call(statsd, stats)
# Allow access to with hardware layer and process stats.
allow statsd proc_uid_cputime_showstat:file { getattr open read };
hal_client_domain(statsd, hal_power)
### ###
### neverallow rules ### neverallow rules
### ###
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment