1typeattribute incidentd coredomain;
2
3init_daemon_domain(incidentd)
4type incidentd_exec, exec_type, file_type;
5binder_use(incidentd)
6wakelock_use(incidentd)
7
8# Allow setting process priority, protect from OOM killer, and dropping
9# privileges by switching UID / GID
10# TODO allow incidentd self:capability { setuid setgid sys_resource };
11
12# Allow incidentd to scan through /proc/pid for all processes
13r_dir_file(incidentd, domain)
14
15allow incidentd self:capability {
16    # Send signals to processes
17    kill
18};
19
20# Allow executing files on system, such as:
21#   /system/bin/toolbox
22#   /system/bin/logcat
23#   /system/bin/dumpsys
24allow incidentd system_file:file execute_no_trans;
25allow incidentd toolbox_exec:file rx_file_perms;
26
27# Create and write into /data/misc/incidents
28allow incidentd incident_data_file:dir rw_dir_perms;
29allow incidentd incident_data_file:file create_file_perms;
30
31# Get process attributes
32# TODO allow incidentd domain:process getattr;
33
34# Signal java processes to dump their stack and get the results
35# TODO allow incidentd { appdomain ephemeral_app system_server }:process signal;
36# TODO allow incidentd anr_data_file:dir rw_dir_perms;
37# TODO allow incidentd anr_data_file:file create_file_perms;
38
39# Signal native processes to dump their stack.
40# This list comes from native_processes_to_dump in incidentd/utils.c
41allow incidentd {
42  audioserver
43  cameraserver
44  drmserver
45  inputflinger
46  mediacodec
47  mediadrmserver
48  mediaextractor
49  mediaserver
50  sdcardd
51  surfaceflinger
52}:process signal;
53
54# Allow incidentd to make binder calls to any binder service
55binder_call(incidentd, binderservicedomain)
56binder_call(incidentd, appdomain)
57
58# Reading /proc/PID/maps of other processes
59# TODO allow incidentd self:capability sys_ptrace;
60
61# Run a shell.
62allow incidentd shell_exec:file rx_file_perms;
63
64# logd access - work to be done is a PII safe log (possibly an event log?)
65# TODO read_logd(incidentd)
66# TODO control_logd(incidentd)
67
68# Allow incidentd to find these standard groups of services.
69# Others can be allowlisted individually.
70allow incidentd {
71  system_server_service
72  app_api_service
73  system_api_service
74}:service_manager find;
75
76# Only incidentd can publish the binder service
77add_service(incidentd, incident_service)
78
79# Allow pipes from (and only from) incident
80allow incidentd incident:fd use;
81allow incidentd incident:fifo_file write;
82
83# Allow incident to call back to incident with status updates.
84binder_call(incidentd, incident)
85
86###
87### neverallow rules
88###
89
90# only system_server, system_app and incident command can find the incident service
91neverallow { domain -system_server -system_app -incident -incidentd } incident_service:service_manager find;
92
93# only incidentd and the other root services in limited circumstances
94# can get to the files in /data/misc/incidents
95#
96# write, execute, append are forbidden almost everywhere
97neverallow { domain -incidentd -init -vold } incident_data_file:file {
98  w_file_perms
99  x_file_perms
100  create
101  rename
102  setattr
103  unlink
104  append
105};
106# read is also allowed by system_server, for when the file is handed to dropbox
107neverallow { domain -incidentd -init -vold -system_server } incident_data_file:file r_file_perms;
108# limited access to the directory itself
109neverallow { domain -incidentd -init -vold } incident_data_file:dir create_dir_perms;
110
111