From cf71a5ae60b1a894d593e5d561d64c07eed1fa12 Mon Sep 17 00:00:00 2001
From: Alan Stokes <alanstokes@google.com>
Date: Tue, 27 Feb 2018 10:42:12 +0000
Subject: [PATCH] Suppress noisy performanced denials in permissive mode.
The sheer volume of these can cause confusion.
Sample denials (repeated for many processes):
denied { getattr } for path="/proc/1/status" dev="proc" ino=24427 scontext=u:r:performanced:s0 tcontext=u:r:init:s0 tclass=file permissive=1
denied { open } for path="/proc/1" dev="proc" ino=18608 scontext=u:r:performanced:s0 tcontext=u:r:init:s0 tclass=dir permissive=1
denied { open } for path="/proc/1/status" dev="proc" ino=24427 scontext=u:r:performanced:s0 tcontext=u:r:init:s0 tclass=file permissive=1
denied { read } for name="status" dev="proc" ino=24427 scontext=u:r:performanced:s0 tcontext=u:r:init:s0 tclass=file permissive=1
Bug: 72643420
Test: Denials no longer present in permissive mode.
Change-Id: Ic07b9b0b59ca2122c4843095b63075ab8fd2c70b
---
public/performanced.te | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/public/performanced.te b/public/performanced.te
index 5f23088ad..248d345d1 100644
--- a/public/performanced.te
+++ b/public/performanced.te
@@ -19,5 +19,12 @@ r_dir_file(performanced, { appdomain bufferhubd kernel surfaceflinger })
dontaudit performanced domain:dir read;
allow performanced { appdomain bufferhubd kernel surfaceflinger }:process setsched;
+# These /proc accesses only show up in permissive mode but they
+# generate a lot of noise in the log.
+userdebug_or_eng(`
+ dontaudit performanced domain:dir open;
+ dontaudit performanced domain:file { open read getattr };
+')
+
# Access /dev/cpuset/cpuset.cpus
r_dir_file(performanced, cgroup)
--
GitLab