1# debugger interface
2type debuggerd, domain;
3type debuggerd_exec, exec_type, file_type;
4
5init_daemon_domain(debuggerd)
6typeattribute debuggerd mlstrustedsubject;
7allow debuggerd self:capability { dac_override sys_ptrace chown kill fowner };
8allow debuggerd self:capability2 { syslog };
9allow debuggerd domain:dir r_dir_perms;
10allow debuggerd domain:file r_file_perms;
11allow debuggerd domain:lnk_file read;
12allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process ptrace;
13security_access_policy(debuggerd)
14allow debuggerd system_data_file:dir create_dir_perms;
15allow debuggerd system_data_file:dir relabelfrom;
16allow debuggerd tombstone_data_file:dir relabelto;
17allow debuggerd tombstone_data_file:dir create_dir_perms;
18allow debuggerd tombstone_data_file:file create_file_perms;
19allow debuggerd shared_relro_file:dir r_dir_perms;
20allow debuggerd shared_relro_file:file r_file_perms;
21allow debuggerd domain:process { sigstop signal };
22allow debuggerd exec_type:file r_file_perms;
23# Access app library
24allow debuggerd system_data_file:file open;
25
26# Connect to system_server via /data/system/ndebugsocket.
27unix_socket_connect(debuggerd, system_ndebug, system_server)
28
29userdebug_or_eng(`
30  allow debuggerd input_device:dir r_dir_perms;
31  allow debuggerd input_device:chr_file rw_file_perms;
32')
33
34# logd access
35read_logd(debuggerd)
36