1# Domain for atrace process.
2# It is spawned either by traced_probes or by init for the boottrace service.
3
4type atrace_exec, exec_type, file_type, system_file_type;
5
6# boottrace services uses /data/misc/boottrace/categories
7allow atrace boottrace_data_file:dir search;
8allow atrace boottrace_data_file:file r_file_perms;
9
10# Allow atrace to access tracefs.
11allow atrace debugfs_tracing:dir r_dir_perms;
12allow atrace debugfs_tracing:file rw_file_perms;
13allow atrace debugfs_trace_marker:file getattr;
14
15# Allow atrace to write data when a pipe is used for stdout/stderr
16# This is used by Perfetto to capture the output on error in atrace.
17allow atrace traced_probes:fd use;
18allow atrace traced_probes:fifo_file write;
19
20# atrace sets debug.atrace.* properties
21set_prop(atrace, debug_prop)
22
23# atrace pokes all the binder-enabled processes at startup with a
24# SYSPROPS_TRANSACTION, to tell them to reload the debug.atrace.* properties.
25
26# Allow discovery of binder services.
27allow atrace {
28  service_manager_type
29  -apex_service
30  -dnsresolver_service
31  -dumpstate_service
32  -incident_service
33  -installd_service
34  -iorapd_service
35  -lpdump_service
36  -netd_service
37  -stats_service
38  -tracingproxy_service
39  -vold_service
40  -default_android_service
41}:service_manager { find };
42allow atrace servicemanager:service_manager list;
43
44# Allow notifying the processes hosting specific binder services that
45# trace-related system properties have changed.
46binder_use(atrace)
47allow atrace healthd:binder call;
48allow atrace surfaceflinger:binder call;
49allow atrace system_server:binder call;
50allow atrace cameraserver:binder call;
51
52# Similarly, on debug builds, allow specific HALs to be notified that
53# trace-related system properties have changed.
54userdebug_or_eng(`
55  # List HAL interfaces.
56  allow atrace hwservicemanager:hwservice_manager list;
57  # Notify the camera HAL.
58  hal_client_domain(atrace, hal_camera)
59  hal_client_domain(atrace, hal_vibrator)
60')
61
62# Remove logspam from notification attempts to non-allowlisted services.
63dontaudit atrace hwservice_manager_type:hwservice_manager find;
64dontaudit atrace service_manager_type:service_manager find;
65dontaudit atrace domain:binder call;
66
67# atrace can call atrace HAL
68hal_client_domain(atrace, hal_atrace)
69
70get_prop(atrace, hwservicemanager_prop)
71
72userdebug_or_eng(`
73  # atrace is generally invoked as a standalone binary from shell or perf
74  # daemons like Perfetto traced_probes. However, in userdebug builds, there is
75  # a further option to run atrace as an init daemon for boot tracing.
76  init_daemon_domain(atrace)
77
78  allow atrace debugfs_tracing_debug:dir r_dir_perms;
79  allow atrace debugfs_tracing_debug:file rw_file_perms;
80')
81