From e9b8bff6c612913b04343e3035aea44260457d34 Mon Sep 17 00:00:00 2001
From: Primiano Tucci <primiano@google.com>
Date: Mon, 26 Mar 2018 01:54:52 +0100
Subject: [PATCH] perfetto: allow traced to write into FDs received by the
client
This allows an optimization that consists in the "perfetto" cmdline
client passing directly the file descriptor for the output trace
to traced (as opposite to having traced streaming back the trace
data to "perfetto" and having that one doing the write() into file).
This reduces sensibly the memory traffic and CPU overhead of traces
with a minor change.
Bug: 73625179
Test: builds + perfetto_integrationtests w/ long_trace.cfg
Change-Id: I81f5a230338ced20dc543fd91c5a0bd0e58725f2
Merged-In: I81f5a230338ced20dc543fd91c5a0bd0e58725f2
(cherry picked from aosp/648831)
---
private/traced.te | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/private/traced.te b/private/traced.te
index b6d03117c..49edc5174 100644
--- a/private/traced.te
+++ b/private/traced.te
@@ -14,6 +14,13 @@ typeattribute traced_tmpfs mlstrustedobject;
# the privileged process that controls it.
allow traced self:global_capability_class_set { sys_nice };
+# Allow to pass a file descriptor for the output trace from "perfetto" (the
+# cmdline client) and other shell binaries to traced and let traced write
+# directly into that (rather than returning the trace contents over the socket).
+allow traced perfetto:fd use;
+allow traced shell:fd use;
+allow traced perfetto_traces_data_file:file { read write };
+
###
### Neverallow rules
###
@@ -42,7 +49,11 @@ neverallow traced {
neverallow traced { system_data_file }:dir ~{ getattr search };
neverallow traced zoneinfo_data_file:dir ~r_dir_perms;
neverallow traced { data_file_type -zoneinfo_data_file }:lnk_file *;
-neverallow traced { data_file_type -zoneinfo_data_file }:file ~write;
+neverallow traced {
+ data_file_type
+ -zoneinfo_data_file
+ -perfetto_traces_data_file
+}:file ~write;
# Only init is allowed to enter the traced domain via exec()
neverallow { domain -init } traced:process transition;
--
GitLab