From bfa3cd51e4ffcac361d36088310f141a7b5d61a7 Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Sun, 5 Jan 2014 19:20:10 -0800
Subject: [PATCH] Allow dumpstate to write shell files
Allow the bugreport service to create files in
/data/data/com.android.shell/files/bugreports/bugreport .
Addresses the following denials:
<5>[31778.629368] type=1400 audit(1388876199.162:230): avc: denied { write } for pid=19092 comm="dumpstate" name="bugreports" dev="mmcblk0p28" ino=1565709 scontext=u:r:dumpstate:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir
<5>[31778.629493] type=1400 audit(1388876199.162:231): avc: denied { add_name } for pid=19092 comm="dumpstate" name="bugreport-2014-01-04-14-56-39.txt.tmp" scontext=u:r:dumpstate:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir
<5>[31778.629622] type=1400 audit(1388876199.162:232): avc: denied { create } for pid=19092 comm="dumpstate" name="bugreport-2014-01-04-14-56-39.txt.tmp" scontext=u:r:dumpstate:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file
<5>[31778.629779] type=1400 audit(1388876199.162:233): avc: denied { write open } for pid=19092 comm="dumpstate" name="bugreport-2014-01-04-14-56-39.txt.tmp" dev="mmcblk0p28" ino=1566628 scontext=u:r:dumpstate:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file
<5>[31778.629977] type=1400 audit(1388876199.162:234): avc: denied { getattr } for pid=19092 comm="dumpstate" path="/data/data/com.android.shell/files/bugreports/bugreport-2014-01-04-14-56-39.txt.tmp" dev="mmcblk0p28" ino=1566628 scontext=u:r:dumpstate:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file
Change-Id: I080613e8a2c989a7b50fde914271967a814c4ff4
---
dumpstate.te | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/dumpstate.te b/dumpstate.te
index 8c2727354..948131e67 100644
--- a/dumpstate.te
+++ b/dumpstate.te
@@ -68,3 +68,8 @@ binder_call(dumpstate, appdomain)
# Reading /proc/PID/maps of other processes
allow dumpstate self:capability sys_ptrace;
+
+# Allow the bugreport service to create a file in
+# /data/data/com.android.shell/files/bugreports/bugreport
+allow dumpstate shell_data_file:dir rw_dir_perms;
+allow dumpstate shell_data_file:file create_file_perms;
--
GitLab