1# dumpstate
2type dumpstate, domain;
3type dumpstate_exec, exec_type, file_type;
4
5init_daemon_domain(dumpstate)
6net_domain(dumpstate)
7binder_use(dumpstate)
8
9# Drop privileges by switching UID / GID
10allow dumpstate self:capability { setuid setgid };
11
12# Allow dumpstate to scan through /proc/pid for all processes
13r_dir_file(dumpstate, domain)
14
15# Send signals to processes
16allow dumpstate self:capability kill;
17
18# Allow executing files on system, such as:
19#   /system/bin/toolbox
20#   /system/bin/logcat
21#   /system/bin/dumpsys
22allow dumpstate system_file:file execute_no_trans;
23
24# Create and write into /data/anr/
25allow dumpstate self:capability { dac_override chown fowner fsetid };
26allow dumpstate anr_data_file:dir { rw_dir_perms relabelto };
27allow dumpstate anr_data_file:file create_file_perms;
28allow dumpstate system_data_file:dir { create_dir_perms relabelfrom };
29
30# Allow reading /data/system/uiderrors.txt
31# TODO: scope this down.
32allow dumpstate system_data_file:file r_file_perms;
33
34# Read dmesg
35allow dumpstate self:capability2 syslog;
36allow dumpstate kernel:system syslog_read;
37
38# Read /sys/fs/pstore/console-ramoops
39allow dumpstate pstorefs:dir r_dir_perms;
40allow dumpstate pstorefs:file r_file_perms;
41
42# Get process attributes
43allow dumpstate domain:process getattr;
44
45# Signal java processes to dump their stack
46allow dumpstate { appdomain system_server }:process signal;
47
48# Signal native processes to dump their stack.
49# This list comes from native_processes_to_dump in dumpstate/utils.c
50allow dumpstate { drmserver mediaserver sdcardd surfaceflinger }:process signal;
51
52# Execute and transition to the vdc domain
53domain_auto_trans(dumpstate, vdc_exec, vdc)
54
55# Vibrate the device after we're done collecting the bugreport
56# /sys/class/timed_output/vibrator/enable
57# TODO: create a new file class, instead of allowing write access to all of /sys
58allow dumpstate sysfs:file w_file_perms;
59
60# Other random bits of data we want to collect
61allow dumpstate qtaguid_proc:file r_file_perms;
62allow dumpstate debugfs:file r_file_perms;
63
64# Allow dumpstate to make binder calls to any binder service
65binder_call(dumpstate, binderservicedomain)
66binder_call(dumpstate, appdomain)
67
68# Reading /proc/PID/maps of other processes
69allow dumpstate self:capability sys_ptrace;
70
71# Allow the bugreport service to create a file in
72# /data/data/com.android.shell/files/bugreports/bugreport
73allow dumpstate shell_data_file:dir create_dir_perms;
74allow dumpstate shell_data_file:file create_file_perms;
75
76# Run a shell.
77allow dumpstate shell_exec:file rx_file_perms;
78
79# For running am and similar framework commands.
80# Run /system/bin/app_process.
81allow dumpstate zygote_exec:file rx_file_perms;
82# Dalvik Compiler JIT.
83allow dumpstate ashmem_device:chr_file execute;
84allow dumpstate dumpstate_tmpfs:file execute;
85allow dumpstate self:process execmem;
86# For art.
87allow dumpstate dalvikcache_data_file:file execute;
88
89# Dumpstate calls screencap, which grabs a screenshot. Needs gpu access
90allow dumpstate gpu_device:chr_file rw_file_perms;
91
92# logd access
93read_logd(dumpstate)
94control_logd(dumpstate)
95
96# Read network state info files.
97allow dumpstate net_data_file:dir search;
98allow dumpstate net_data_file:file r_file_perms;
99
100# Access /data/tombstones.
101allow dumpstate tombstone_data_file:dir r_dir_perms;
102allow dumpstate tombstone_data_file:file r_file_perms;
103
104# Access /system/bin executables to determine type of executable.
105allow dumpstate {drmserver_exec mediaserver_exec sdcardd_exec surfaceflinger_exec}:file r_file_perms;
106