1##################################### 2# domain_trans(olddomain, type, newdomain) 3# Allow a transition from olddomain to newdomain 4# upon executing a file labeled with type. 5# This only allows the transition; it does not 6# cause it to occur automatically - use domain_auto_trans 7# if that is what you want. 8# 9define(`domain_trans', ` 10# Old domain may exec the file and transition to the new domain. 11allow $1 $2:file { getattr open read execute map }; 12allow $1 $3:process transition; 13# New domain is entered by executing the file. 14allow $3 $2:file { entrypoint open read execute getattr map }; 15# New domain can send SIGCHLD to its caller. 16ifelse($1, `init', `', `allow $3 $1:process sigchld;') 17# Enable AT_SECURE, i.e. libc secure mode. 18dontaudit $1 $3:process noatsecure; 19# XXX dontaudit candidate but requires further study. 20allow $1 $3:process { siginh rlimitinh }; 21') 22 23##################################### 24# domain_auto_trans(olddomain, type, newdomain) 25# Automatically transition from olddomain to newdomain 26# upon executing a file labeled with type. 27# 28define(`domain_auto_trans', ` 29# Allow the necessary permissions. 30domain_trans($1,$2,$3) 31# Make the transition occur by default. 32type_transition $1 $2:process $3; 33') 34 35##################################### 36# file_type_trans(domain, dir_type, file_type) 37# Allow domain to create a file labeled file_type in a 38# directory labeled dir_type. 39# This only allows the transition; it does not 40# cause it to occur automatically - use file_type_auto_trans 41# if that is what you want. 42# 43define(`file_type_trans', ` 44# Allow the domain to add entries to the directory. 45allow $1 $2:dir ra_dir_perms; 46# Allow the domain to create the file. 47allow $1 $3:notdevfile_class_set create_file_perms; 48allow $1 $3:dir create_dir_perms; 49') 50 51##################################### 52# file_type_auto_trans(domain, dir_type, file_type) 53# Automatically label new files with file_type when 54# they are created by domain in directories labeled dir_type. 55# 56define(`file_type_auto_trans', ` 57# Allow the necessary permissions. 58file_type_trans($1, $2, $3) 59# Make the transition occur by default. 60type_transition $1 $2:dir $3; 61type_transition $1 $2:notdevfile_class_set $3; 62') 63 64##################################### 65# r_dir_file(domain, type) 66# Allow the specified domain to read directories, files 67# and symbolic links of the specified type. 68define(`r_dir_file', ` 69allow $1 $2:dir r_dir_perms; 70allow $1 $2:{ file lnk_file } r_file_perms; 71') 72 73##################################### 74# tmpfs_domain(domain) 75# Allow access to a unique type for this domain when creating tmpfs / ashmem files. 76define(`tmpfs_domain', ` 77type_transition $1 tmpfs:file $1_tmpfs; 78allow $1 $1_tmpfs:file { read write getattr map }; 79') 80 81# pdx macros for IPC. pdx is a high-level name which contains transport-specific 82# rules from underlying transport (e.g. UDS-based implementation). 83 84##################################### 85# pdx_service_attributes(service) 86# Defines type attribute used to identify various service-related types. 87define(`pdx_service_attributes', ` 88attribute pdx_$1_endpoint_dir_type; 89attribute pdx_$1_endpoint_socket_type; 90attribute pdx_$1_channel_socket_type; 91attribute pdx_$1_server_type; 92') 93 94##################################### 95# pdx_service_socket_types(service, endpoint_dir_t) 96# Define types for endpoint and channel sockets. 97define(`pdx_service_socket_types', ` 98typeattribute $2 pdx_$1_endpoint_dir_type; 99type pdx_$1_endpoint_socket, pdx_$1_endpoint_socket_type, pdx_endpoint_socket_type, file_type, coredomain_socket, mlstrustedobject, mlstrustedsubject; 100type pdx_$1_channel_socket, pdx_$1_channel_socket_type, pdx_channel_socket_type, coredomain_socket; 101userdebug_or_eng(` 102dontaudit su pdx_$1_endpoint_socket:unix_stream_socket *; 103dontaudit su pdx_$1_channel_socket:unix_stream_socket *; 104') 105') 106 107##################################### 108# pdx_server(server_domain, service) 109define(`pdx_server', ` 110# Mark the server domain as a PDX server. 111typeattribute $1 pdx_$2_server_type; 112# Allow the init process to create the initial endpoint socket. 113allow init pdx_$2_endpoint_socket_type:unix_stream_socket { create bind }; 114# Allow the server domain to use the endpoint socket and accept connections on it. 115# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights 116# than we need (e.g. we don"t need "bind" or "connect"). 117allow $1 pdx_$2_endpoint_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown listen accept }; 118# Allow the server domain to apply security context label to the channel socket pair (allow process to use setsockcreatecon_raw()). 119allow $1 self:process setsockcreate; 120# Allow the server domain to create a client channel socket. 121allow $1 pdx_$2_channel_socket_type:unix_stream_socket create_stream_socket_perms; 122# Prevent other processes from claiming to be a server for the same service. 123neverallow {domain -$1} pdx_$2_endpoint_socket_type:unix_stream_socket { listen accept }; 124') 125 126##################################### 127# pdx_connect(client, service) 128define(`pdx_connect', ` 129# Allow client to open the service endpoint file. 130allow $1 pdx_$2_endpoint_dir_type:dir r_dir_perms; 131allow $1 pdx_$2_endpoint_socket_type:sock_file rw_file_perms; 132# Allow the client to connect to endpoint socket. 133allow $1 pdx_$2_endpoint_socket_type:unix_stream_socket { connectto read write shutdown }; 134') 135 136##################################### 137# pdx_use(client, service) 138define(`pdx_use', ` 139# Allow the client to use the PDX channel socket. 140# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights 141# than we need (e.g. we don"t need "bind" or "connect"). 142allow $1 pdx_$2_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown }; 143# Client needs to use an channel event fd from the server. 144allow $1 pdx_$2_server_type:fd use; 145# Servers may receive sync fences, gralloc buffers, etc, from clients. 146# This could be tightened on a per-server basis, but keeping track of service 147# clients is error prone. 148allow pdx_$2_server_type $1:fd use; 149') 150 151##################################### 152# pdx_client(client, service) 153define(`pdx_client', ` 154pdx_connect($1, $2) 155pdx_use($1, $2) 156') 157 158##################################### 159# init_daemon_domain(domain) 160# Set up a transition from init to the daemon domain 161# upon executing its binary. 162define(`init_daemon_domain', ` 163domain_auto_trans(init, $1_exec, $1) 164') 165 166##################################### 167# app_domain(domain) 168# Allow a base set of permissions required for all apps. 169define(`app_domain', ` 170typeattribute $1 appdomain; 171# Label tmpfs objects for all apps. 172type_transition $1 tmpfs:file appdomain_tmpfs; 173allow $1 appdomain_tmpfs:file { execute getattr map read write }; 174neverallow { $1 -runas_app -shell } { domain -$1 }:file no_rw_file_perms; 175neverallow { appdomain -runas_app -shell -$1 } $1:file no_rw_file_perms; 176# The Android security model guarantees the confidentiality and integrity 177# of application data and execution state. Ptrace bypasses those 178# confidentiality guarantees. Disallow ptrace access from system components 179# to apps. Crash_dump is excluded, as it needs ptrace access to 180# produce stack traces. llkd is excluded, as it needs to inspect 181# the kernel stack for live lock conditions. runas_app is excluded, as it can 182# only access debuggable apps. 183neverallow { domain -$1 -crash_dump userdebug_or_eng(`-llkd') -runas_app } $1:process ptrace; 184') 185 186##################################### 187# untrusted_app_domain(domain) 188# Allow a base set of permissions required for all untrusted apps. 189define(`untrusted_app_domain', ` 190typeattribute $1 untrusted_app_all; 191') 192 193##################################### 194# net_domain(domain) 195# Allow a base set of permissions required for network access. 196define(`net_domain', ` 197typeattribute $1 netdomain; 198') 199 200##################################### 201# bluetooth_domain(domain) 202# Allow a base set of permissions required for bluetooth access. 203define(`bluetooth_domain', ` 204typeattribute $1 bluetoothdomain; 205') 206 207##################################### 208# hal_attribute(hal_name) 209# Add an attribute for hal implementations along with necessary 210# restrictions. 211define(`hal_attribute', ` 212attribute hal_$1; 213expandattribute hal_$1 true; 214attribute hal_$1_client; 215expandattribute hal_$1_client true; 216attribute hal_$1_server; 217expandattribute hal_$1_server false; 218 219neverallow { hal_$1_server -halserverdomain } domain:process fork; 220# hal_*_client and halclientdomain attributes are always expanded for 221# performance reasons. Neverallow rules targeting expanded attributes can not be 222# verified by CTS since these attributes are already expanded by that time. 223build_test_only(` 224neverallow { hal_$1_server -hal_$1 } domain:process fork; 225neverallow { hal_$1_client -halclientdomain } domain:process fork; 226') 227') 228 229##################################### 230# hal_server_domain(domain, hal_type) 231# Allow a base set of permissions required for a domain to offer a 232# HAL implementation of the specified type over HwBinder. 233# 234# For example, default implementation of Foo HAL: 235# type hal_foo_default, domain; 236# hal_server_domain(hal_foo_default, hal_foo) 237# 238define(`hal_server_domain', ` 239typeattribute $1 halserverdomain; 240typeattribute $1 $2_server; 241typeattribute $1 $2; 242') 243 244##################################### 245# hal_client_domain(domain, hal_type) 246# Allow a base set of permissions required for a domain to be a 247# client of a HAL of the specified type. 248# 249# For example, make some_domain a client of Foo HAL: 250# hal_client_domain(some_domain, hal_foo) 251# 252define(`hal_client_domain', ` 253typeattribute $1 halclientdomain; 254typeattribute $1 $2_client; 255 256# TODO(b/34170079): Make the inclusion of the rules below conditional also on 257# non-Treble devices. For now, on non-Treble device, always grant clients of a 258# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process). 259not_full_treble(` 260typeattribute $1 $2; 261# Find passthrough HAL implementations 262allow $2 system_file:dir r_dir_perms; 263allow $2 vendor_file:dir r_dir_perms; 264allow $2 vendor_file:file { read open getattr execute map }; 265') 266') 267 268##################################### 269# passthrough_hal_client_domain(domain, hal_type) 270# Allow a base set of permissions required for a domain to be a 271# client of a passthrough HAL of the specified type. 272# 273# For example, make some_domain a client of passthrough Foo HAL: 274# passthrough_hal_client_domain(some_domain, hal_foo) 275# 276define(`passthrough_hal_client_domain', ` 277typeattribute $1 halclientdomain; 278typeattribute $1 $2_client; 279typeattribute $1 $2; 280# Find passthrough HAL implementations 281allow $2 system_file:dir r_dir_perms; 282allow $2 vendor_file:dir r_dir_perms; 283allow $2 vendor_file:file { read open getattr execute map }; 284') 285 286##################################### 287# unix_socket_connect(clientdomain, socket, serverdomain) 288# Allow a local socket connection from clientdomain via 289# socket to serverdomain. 290# 291# Note: If you see denial records that distill to the 292# following allow rules: 293# allow clientdomain property_socket:sock_file write; 294# allow clientdomain init:unix_stream_socket connectto; 295# allow clientdomain something_prop:property_service set; 296# 297# This sequence is indicative of attempting to set a property. 298# use set_prop(sourcedomain, targetproperty) 299# 300define(`unix_socket_connect', ` 301allow $1 $2_socket:sock_file write; 302allow $1 $3:unix_stream_socket connectto; 303') 304 305##################################### 306# set_prop(sourcedomain, targetproperty) 307# Allows source domain to set the 308# targetproperty. 309# 310define(`set_prop', ` 311unix_socket_connect($1, property, init) 312allow $1 $2:property_service set; 313get_prop($1, $2) 314') 315 316##################################### 317# get_prop(sourcedomain, targetproperty) 318# Allows source domain to read the 319# targetproperty. 320# 321define(`get_prop', ` 322allow $1 $2:file { getattr open read map }; 323') 324 325##################################### 326# unix_socket_send(clientdomain, socket, serverdomain) 327# Allow a local socket send from clientdomain via 328# socket to serverdomain. 329define(`unix_socket_send', ` 330allow $1 $2_socket:sock_file write; 331allow $1 $3:unix_dgram_socket sendto; 332') 333 334##################################### 335# binder_use(domain) 336# Allow domain to use Binder IPC. 337define(`binder_use', ` 338# Call the servicemanager and transfer references to it. 339allow $1 servicemanager:binder { call transfer }; 340# servicemanager performs getpidcon on clients. 341allow servicemanager $1:dir search; 342allow servicemanager $1:file { read open }; 343allow servicemanager $1:process getattr; 344# rw access to /dev/binder and /dev/ashmem is presently granted to 345# all domains in domain.te. 346') 347 348##################################### 349# hwbinder_use(domain) 350# Allow domain to use HwBinder IPC. 351define(`hwbinder_use', ` 352# Call the hwservicemanager and transfer references to it. 353allow $1 hwservicemanager:binder { call transfer }; 354# Allow hwservicemanager to send out callbacks 355allow hwservicemanager $1:binder { call transfer }; 356# hwservicemanager performs getpidcon on clients. 357allow hwservicemanager $1:dir search; 358allow hwservicemanager $1:file { read open map }; 359allow hwservicemanager $1:process getattr; 360# rw access to /dev/hwbinder and /dev/ashmem is presently granted to 361# all domains in domain.te. 362') 363 364##################################### 365# vndbinder_use(domain) 366# Allow domain to use Binder IPC. 367define(`vndbinder_use', ` 368# Talk to the vndbinder device node 369allow $1 vndbinder_device:chr_file rw_file_perms; 370# Call the vndservicemanager and transfer references to it. 371allow $1 vndservicemanager:binder { call transfer }; 372# vndservicemanager performs getpidcon on clients. 373allow vndservicemanager $1:dir search; 374allow vndservicemanager $1:file { read open map }; 375allow vndservicemanager $1:process getattr; 376') 377 378##################################### 379# binder_call(clientdomain, serverdomain) 380# Allow clientdomain to perform binder IPC to serverdomain. 381define(`binder_call', ` 382# Call the server domain and optionally transfer references to it. 383allow $1 $2:binder { call transfer }; 384# Allow the serverdomain to transfer references to the client on the reply. 385allow $2 $1:binder transfer; 386# Receive and use open files from the server. 387allow $1 $2:fd use; 388') 389 390##################################### 391# binder_service(domain) 392# Mark a domain as being a Binder service domain. 393# Used to allow binder IPC to the various system services. 394define(`binder_service', ` 395typeattribute $1 binderservicedomain; 396') 397 398##################################### 399# wakelock_use(domain) 400# Allow domain to manage wake locks 401define(`wakelock_use', ` 402# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is 403# deprecated. 404# Access /sys/power/wake_lock and /sys/power/wake_unlock 405allow $1 sysfs_wake_lock:file rw_file_perms; 406# Accessing these files requires CAP_BLOCK_SUSPEND 407allow $1 self:global_capability2_class_set block_suspend; 408# system_suspend permissions 409binder_call($1, system_suspend_server) 410allow $1 system_suspend_hwservice:hwservice_manager find; 411# halclientdomain permissions 412hwbinder_use($1) 413get_prop($1, hwservicemanager_prop) 414allow $1 hidl_manager_hwservice:hwservice_manager find; 415') 416 417##################################### 418# selinux_check_access(domain) 419# Allow domain to check SELinux permissions via selinuxfs. 420define(`selinux_check_access', ` 421r_dir_file($1, selinuxfs) 422allow $1 selinuxfs:file w_file_perms; 423allow $1 kernel:security compute_av; 424allow $1 self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind }; 425') 426 427##################################### 428# selinux_check_context(domain) 429# Allow domain to check SELinux contexts via selinuxfs. 430define(`selinux_check_context', ` 431r_dir_file($1, selinuxfs) 432allow $1 selinuxfs:file w_file_perms; 433allow $1 kernel:security check_context; 434') 435 436##################################### 437# create_pty(domain) 438# Allow domain to create and use a pty, isolated from any other domain ptys. 439define(`create_pty', ` 440# Each domain gets a unique devpts type. 441type $1_devpts, fs_type; 442# Label the pty with the unique type when created. 443type_transition $1 devpts:chr_file $1_devpts; 444# Allow use of the pty after creation. 445allow $1 $1_devpts:chr_file { open getattr read write ioctl }; 446allowxperm $1 $1_devpts:chr_file ioctl unpriv_tty_ioctls; 447# TIOCSTI is only ever used for exploits. Block it. 448# b/33073072, b/7530569 449# http://www.openwall.com/lists/oss-security/2016/09/26/14 450neverallowxperm * $1_devpts:chr_file ioctl TIOCSTI; 451# Note: devpts:dir search and ptmx_device:chr_file rw_file_perms 452# allowed to everyone via domain.te. 453') 454 455##################################### 456# Non system_app application set 457# 458define(`non_system_app_set', `{ appdomain -system_app }') 459 460##################################### 461# Recovery only 462# SELinux rules which apply only to recovery mode 463# 464define(`recovery_only', ifelse(target_recovery, `true', $1, )) 465 466##################################### 467# Full TREBLE only 468# SELinux rules which apply only to full TREBLE devices 469# 470define(`full_treble_only', ifelse(target_full_treble, `true', $1, 471ifelse(target_full_treble, `cts', 472# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify 473$1 474# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify 475, ))) 476 477##################################### 478# Not full TREBLE 479# SELinux rules which apply only to devices which are not full TREBLE devices 480# 481define(`not_full_treble', ifelse(target_full_treble, `true', , $1)) 482 483##################################### 484# Compatible property only 485# SELinux rules which apply only to devices with compatible property 486# 487define(`compatible_property_only', ifelse(target_compatible_property, `true', $1, 488ifelse(target_compatible_property, `cts', 489# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify 490$1 491# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify 492, ))) 493 494##################################### 495# Not compatible property 496# SELinux rules which apply only to devices without compatible property 497# 498define(`not_compatible_property', ifelse(target_compatible_property, `true', , $1)) 499 500##################################### 501# Userdebug or eng builds 502# SELinux rules which apply only to userdebug or eng builds 503# 504define(`userdebug_or_eng', ifelse(target_build_variant, `eng', $1, ifelse(target_build_variant, `userdebug', $1))) 505 506##################################### 507# asan builds 508# SELinux rules which apply only to asan builds 509# 510define(`with_asan', ifelse(target_with_asan, `true', userdebug_or_eng(`$1'), )) 511 512##################################### 513# native coverage builds 514# SELinux rules which apply only to builds with native coverage 515# 516define(`with_native_coverage', ifelse(target_with_native_coverage, `true', userdebug_or_eng(`$1'), )) 517 518##################################### 519# Build-time-only test 520# SELinux rules which are verified during build, but not as part of *TS testing. 521# 522define(`build_test_only', ifelse(target_exclude_build_test, `true', , $1)) 523 524#################################### 525# Fallback crash handling for processes that can't exec crash_dump (e.g. because of seccomp). 526# 527define(`crash_dump_fallback', ` 528userdebug_or_eng(` 529 allow $1 su:fifo_file append; 530') 531allow $1 anr_data_file:file append; 532allow $1 dumpstate:fd use; 533allow $1 incidentd:fd use; 534# TODO: Figure out why write is needed. 535allow $1 dumpstate:fifo_file { append write }; 536allow $1 incidentd:fifo_file { append write }; 537allow $1 system_server:fifo_file { append write }; 538allow $1 tombstoned:unix_stream_socket connectto; 539allow $1 tombstoned:fd use; 540allow $1 tombstoned_crash_socket:sock_file write; 541allow $1 tombstone_data_file:file append; 542') 543 544##################################### 545# WITH_DEXPREOPT builds 546# SELinux rules which apply only when pre-opting. 547# 548define(`with_dexpreopt', ifelse(target_with_dexpreopt, `true', $1)) 549 550##################################### 551# write_logd(domain) 552# Ability to write to android log 553# daemon via sockets 554define(`write_logd', ` 555unix_socket_send($1, logdw, logd) 556allow $1 pmsg_device:chr_file w_file_perms; 557') 558 559##################################### 560# read_logd(domain) 561# Ability to run logcat and read from android 562# log daemon via sockets 563define(`read_logd', ` 564allow $1 logcat_exec:file rx_file_perms; 565unix_socket_connect($1, logdr, logd) 566') 567 568##################################### 569# read_runtime_log_tags(domain) 570# ability to directly map the runtime event log tags 571define(`read_runtime_log_tags', ` 572allow $1 runtime_event_log_tags_file:file r_file_perms; 573') 574 575##################################### 576# control_logd(domain) 577# Ability to control 578# android log daemon via sockets 579define(`control_logd', ` 580# Group AID_LOG checked by filesystem & logd 581# to permit control commands 582unix_socket_connect($1, logd, logd) 583') 584 585##################################### 586# use_keystore(domain) 587# Ability to use keystore. 588# Keystore is requires the following permissions 589# to call getpidcon. 590define(`use_keystore', ` 591 allow keystore $1:dir search; 592 allow keystore $1:file { read open }; 593 allow keystore $1:process getattr; 594 allow $1 keystore_service:service_manager find; 595 binder_call($1, keystore) 596 binder_call(keystore, $1) 597') 598 599########################################### 600# use_drmservice(domain) 601# Ability to use DrmService which requires 602# DrmService to call getpidcon. 603define(`use_drmservice', ` 604 allow drmserver $1:dir search; 605 allow drmserver $1:file { read open }; 606 allow drmserver $1:process getattr; 607') 608 609########################################### 610# add_service(domain, service) 611# Ability for domain to add a service to service_manager 612# and find it. It also creates a neverallow preventing 613# others from adding it. 614define(`add_service', ` 615 allow $1 $2:service_manager { add find }; 616 neverallow { domain -$1 } $2:service_manager add; 617') 618 619########################################### 620# add_hwservice(domain, service) 621# Ability for domain to add a service to hwservice_manager 622# and find it. It also creates a neverallow preventing 623# others from adding it. 624define(`add_hwservice', ` 625 allow $1 $2:hwservice_manager { add find }; 626 allow $1 hidl_base_hwservice:hwservice_manager add; 627 neverallow { domain -$1 } $2:hwservice_manager add; 628') 629 630########################################### 631# hal_attribute_hwservice(attribute, service) 632# Ability for domain to get a service to hwservice_manager 633# and find it. It also creates a neverallow preventing 634# others from adding it. 635# 636# Used to pair hal_foo_client with hal_foo_hwservice 637define(`hal_attribute_hwservice', ` 638 allow $1_client $2:hwservice_manager find; 639 add_hwservice($1_server, $2) 640 641 build_test_only(` 642 neverallow { domain -$1_client -$1_server } $2:hwservice_manager find; 643 ') 644') 645 646################################### 647# can_profile_heap(domain) 648# Allow processes within the domain to have their heap profiled by heapprofd. 649# 650# Note that profiling is performed differently between debug and user builds. 651# This macro covers both user and debug builds, but see 652# can_profile_heap_userdebug_or_eng for a variant that can be used when 653# allowing profiling for a domain only on debug builds, without granting 654# the exec permission. The exec permission is necessary for user builds, but 655# only a nice-to-have for development and testing purposes on debug builds. 656define(`can_profile_heap', ` 657 # Allow central daemon to send signal for client initialization. 658 allow heapprofd $1:process signal; 659 660 # Allow executing a private heapprofd process to handle profiling on 661 # user builds (also debug builds for testing & development purposes). 662 allow $1 heapprofd_exec:file rx_file_perms; 663 664 # Allow directory & file read to the central heapprofd daemon, as it scans 665 # /proc/[pid]/cmdline for by-process-name profiling configs. 666 # Note that this excludes /proc/[pid]/mem, as it requires ptrace capabilities. 667 allow heapprofd $1:file r_file_perms; 668 allow heapprofd $1:dir r_dir_perms; 669 670 # Profilability on user implies profilability on userdebug and eng. 671 can_profile_heap_userdebug_or_eng($1) 672') 673 674################################### 675# can_profile_heap_userdebug_or_eng(domain) 676# Allow processes within the domain to have their heap profiled by heapprofd on 677# debug builds only. 678# 679# Only necessary when can_profile_heap cannot be applied, see its description 680# for rationale. 681define(`can_profile_heap_userdebug_or_eng', ` 682 userdebug_or_eng(` 683 # Allow central daemon to send signal for client initialization. 684 allow heapprofd $1:process signal; 685 # Allow connecting to the daemon. 686 unix_socket_connect($1, heapprofd, heapprofd) 687 # Allow daemon to use the passed fds. 688 allow heapprofd $1:fd use; 689 # Allow to read and write to heapprofd shmem. 690 # The client needs to read the read and write pointers in order to write. 691 allow $1 heapprofd_tmpfs:file { read write getattr map }; 692 # Use shared memory received over the unix socket. 693 allow $1 heapprofd:fd use; 694 695 # To read from the received file descriptors. 696 # /proc/[pid]/maps and /proc/[pid]/mem have the same SELinux label as the 697 # process they relate to. 698 allow heapprofd $1:file r_file_perms; 699 # Allow searching the /proc/[pid] directory for cmdline. 700 allow heapprofd $1:dir r_dir_perms; 701 ') 702') 703 704################################### 705# never_profile_heap(domain) 706# Opt out of heap profiling by heapprofd. 707define(`never_profile_heap', ` 708 neverallow heapprofd $1:file read; 709 neverallow heapprofd $1:process signal; 710') 711