1# Perfetto tracing probes, has tracefs access. 2type traced_probes_exec, system_file_type, exec_type, file_type; 3type traced_probes_tmpfs, file_type; 4 5# Allow init to exec the daemon. 6init_daemon_domain(traced_probes) 7tmpfs_domain(traced_probes) 8 9# Write trace data to the Perfetto traced damon. This requires connecting to its 10# producer socket and obtaining a (per-process) tmpfs fd. 11perfetto_producer(traced_probes) 12 13# Allow traced_probes to access tracefs. 14allow traced_probes debugfs_tracing:dir r_dir_perms; 15allow traced_probes debugfs_tracing:file rw_file_perms; 16allow traced_probes debugfs_trace_marker:file getattr; 17allow traced_probes debugfs_tracing_printk_formats:file r_file_perms; 18 19# Allow traced_probes to access mm_events trace instance 20allow traced_probes debugfs_tracing_instances:dir search; 21allow traced_probes debugfs_mm_events_tracing:dir search; 22allow traced_probes debugfs_mm_events_tracing:file rw_file_perms; 23 24# TODO(primiano): temporarily I/O tracing categories are still 25# userdebug only until we nail down the denylist/allowlist. 26userdebug_or_eng(` 27allow traced_probes debugfs_tracing_debug:dir r_dir_perms; 28allow traced_probes debugfs_tracing_debug:file rw_file_perms; 29') 30 31# Allow traced_probes to start with a higher scheduling class and then downgrade 32# itself. 33allow traced_probes self:global_capability_class_set { sys_nice }; 34 35# Allow procfs access 36r_dir_file(traced_probes, domain) 37 38# Allow to temporarily lift the kptr_restrict setting and build a symbolization 39# map reading /proc/kallsyms. 40userdebug_or_eng(`set_prop(traced_probes, lower_kptr_restrict_prop)') 41allow traced_probes proc_kallsyms:file r_file_perms; 42 43# Allow to read packages.list file. 44allow traced_probes packages_list_file:file r_file_perms; 45 46# Allow to log to kernel dmesg when starting / stopping ftrace. 47allow traced_probes kmsg_device:chr_file write; 48 49# Allow traced_probes to list the system partition. 50allow traced_probes system_file:dir { open read }; 51 52# Allow traced_probes to list some of the data partition. 53allow traced_probes self:global_capability_class_set dac_read_search; 54 55allow traced_probes apk_data_file:dir { getattr open read search }; 56allow traced_probes { apex_art_data_file apex_module_data_file }:dir { getattr open read search }; 57allow traced_probes dalvikcache_data_file:dir { getattr open read search }; 58userdebug_or_eng(` 59# search and getattr are granted via domain and coredomain, respectively. 60allow traced_probes system_data_file:dir { open read }; 61') 62allow traced_probes system_app_data_file:dir { getattr open read search }; 63allow traced_probes backup_data_file:dir { getattr open read search }; 64allow traced_probes bootstat_data_file:dir { getattr open read search }; 65allow traced_probes update_engine_data_file:dir { getattr open read search }; 66allow traced_probes update_engine_log_data_file:dir { getattr open read search }; 67allow traced_probes { user_profile_root_file user_profile_data_file}:dir { getattr open read search }; 68 69# Allow traced_probes to run atrace. atrace pokes at system services to enable 70# their userspace TRACE macros. 71domain_auto_trans(traced_probes, atrace_exec, atrace); 72 73# Allow traced_probes to kill atrace on timeout. 74allow traced_probes atrace:process sigkill; 75 76# Allow traced_probes to access /proc files for system stats. 77# Note: trace data is NOT exposed to anything other than shell and privileged 78# system apps that have access to the traced consumer socket. 79allow traced_probes { 80 proc_meminfo 81 proc_vmstat 82 proc_stat 83}:file r_file_perms; 84 85# Allow access to read /sys/class/devfreq/ and /$DEVICE/cur_freq files 86allow traced_probes sysfs_devfreq_dir:dir r_dir_perms; 87allow traced_probes sysfs_devfreq_cur:file r_file_perms; 88 89# Allow access to the IHealth and IPowerStats HAL service for tracing battery counters. 90hal_client_domain(traced_probes, hal_health) 91hal_client_domain(traced_probes, hal_power_stats) 92 93# Allow access to Atrace HAL for enabling vendor/device specific tracing categories. 94hal_client_domain(traced_probes, hal_atrace) 95 96# On debug builds allow to ingest system logs into the trace. 97userdebug_or_eng(`read_logd(traced_probes)') 98 99# Allow traced_probes to talk to statsd for logging metrics. 100unix_socket_send(traced_probes, statsdw, statsd) 101 102### 103### Neverallow rules 104### 105### traced_probes should NEVER do any of this 106 107# Disallow mapping executable memory (execstack and exec are already disallowed 108# globally in domain.te). 109neverallow traced_probes self:process execmem; 110 111# Block device access. 112neverallow traced_probes dev_type:blk_file { read write }; 113 114# ptrace any other app 115neverallow traced_probes domain:process ptrace; 116 117# Disallows access to /data files. 118neverallow traced_probes { 119 data_file_type 120 -apex_module_data_file 121 -apex_art_data_file 122 -apk_data_file 123 -dalvikcache_data_file 124 -system_data_file 125 -system_data_root_file 126 -system_app_data_file 127 -backup_data_file 128 -bootstat_data_file 129 -update_engine_data_file 130 -update_engine_log_data_file 131 -user_profile_root_file 132 -user_profile_data_file 133 # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a 134 # subsequent neverallow. Currently only getattr and search are allowed. 135 -vendor_data_file 136 -zoneinfo_data_file 137 with_native_coverage(`-method_trace_data_file') 138}:dir *; 139neverallow traced_probes system_data_file:dir ~{ getattr userdebug_or_eng(`open read') search }; 140neverallow traced_probes zoneinfo_data_file:dir ~r_dir_perms; 141neverallow traced_probes { data_file_type -zoneinfo_data_file }:lnk_file *; 142neverallow traced_probes { 143 data_file_type 144 -zoneinfo_data_file 145 -packages_list_file 146 with_native_coverage(`-method_trace_data_file') 147}:file *; 148 149# Only init is allowed to enter the traced_probes domain via exec() 150neverallow { domain -init } traced_probes:process transition; 151neverallow * traced_probes:process dyntransition; 152 153