1# dumpstate
2type dumpstate, domain, mlstrustedsubject;
3type dumpstate_exec, exec_type, file_type;
4
5net_domain(dumpstate)
6binder_use(dumpstate)
7wakelock_use(dumpstate)
8
9# Allow setting process priority, protect from OOM killer, and dropping
10# privileges by switching UID / GID
11allow dumpstate self:capability { setuid setgid sys_resource };
12
13# Allow dumpstate to scan through /proc/pid for all processes
14r_dir_file(dumpstate, domain)
15
16allow dumpstate self:capability {
17    # Send signals to processes
18    kill
19    # Run iptables
20    net_raw
21    net_admin
22};
23
24# Allow executing files on system, such as:
25#   /system/bin/toolbox
26#   /system/bin/logcat
27#   /system/bin/dumpsys
28allow dumpstate system_file:file execute_no_trans;
29not_full_treble(`allow dumpstate vendor_file:file execute_no_trans;')
30allow dumpstate toolbox_exec:file rx_file_perms;
31
32# hidl searches for files in /system/lib(64)/hw/
33allow dumpstate system_file:dir r_dir_perms;
34
35# Create and write into /data/anr/
36allow dumpstate self:capability { dac_override chown fowner fsetid };
37allow dumpstate anr_data_file:dir rw_dir_perms;
38allow dumpstate anr_data_file:file create_file_perms;
39
40# Allow reading /data/system/uiderrors.txt
41# TODO: scope this down.
42allow dumpstate system_data_file:file r_file_perms;
43
44# Read dmesg
45allow dumpstate self:capability2 syslog;
46allow dumpstate kernel:system syslog_read;
47
48# Read /sys/fs/pstore/console-ramoops
49allow dumpstate pstorefs:dir r_dir_perms;
50allow dumpstate pstorefs:file r_file_perms;
51
52# Get process attributes
53allow dumpstate domain:process getattr;
54
55# Signal java processes to dump their stack
56allow dumpstate { appdomain system_server }:process signal;
57
58# Signal native processes to dump their stack.
59allow dumpstate {
60  # This list comes from native_processes_to_dump in dumpstate/utils.c
61  audioserver
62  cameraserver
63  drmserver
64  inputflinger
65  mediadrmserver
66  mediaextractor
67  mediaserver
68  sdcardd
69  surfaceflinger
70
71  # This list comes from hal_interfaces_to_dump in dumpstate/utils.c
72  hal_audio_server
73  hal_bluetooth_server
74  hal_camera_server
75  hal_graphics_composer_server
76  hal_sensors_server
77  hal_vr_server
78  mediacodec # TODO(b/36375899): hal_omx_server
79}:process signal;
80
81# Connect to tombstoned to intercept dumps.
82unix_socket_connect(dumpstate, tombstoned_intercept, tombstoned)
83
84# TODO: added to match above sysfs rule. Remove me?
85allow dumpstate sysfs_usb:file w_file_perms;
86
87# Other random bits of data we want to collect
88allow dumpstate qtaguid_proc:file r_file_perms;
89allow dumpstate debugfs:file r_file_perms;
90
91# df for
92allow dumpstate {
93  block_device
94  cache_file
95  rootfs
96  selinuxfs
97  storage_file
98  tmpfs
99}:dir { search getattr };
100allow dumpstate fuse_device:chr_file getattr;
101allow dumpstate { dm_device cache_block_device }:blk_file getattr;
102allow dumpstate { cache_file rootfs }:lnk_file { getattr read };
103
104# Read /dev/cpuctl and /dev/cpuset
105r_dir_file(dumpstate, cgroup)
106
107# Allow dumpstate to make binder calls to any binder service
108binder_call(dumpstate, binderservicedomain)
109binder_call(dumpstate, { appdomain netd wificond })
110
111hal_client_domain(dumpstate, hal_dumpstate)
112hal_client_domain(dumpstate, hal_graphics_allocator)
113# Vibrate the device after we are done collecting the bugreport
114hal_client_domain(dumpstate, hal_vibrator)
115# For passthrough mode:
116allow dumpstate sysfs_vibrator:file { rw_file_perms getattr };
117
118# Reading /proc/PID/maps of other processes
119allow dumpstate self:capability sys_ptrace;
120
121# Allow the bugreport service to create a file in
122# /data/data/com.android.shell/files/bugreports/bugreport
123allow dumpstate shell_data_file:dir create_dir_perms;
124allow dumpstate shell_data_file:file create_file_perms;
125
126# Run a shell.
127allow dumpstate shell_exec:file rx_file_perms;
128
129# For running am and similar framework commands.
130# Run /system/bin/app_process.
131allow dumpstate zygote_exec:file rx_file_perms;
132# Dalvik Compiler JIT.
133allow dumpstate ashmem_device:chr_file execute;
134allow dumpstate self:process execmem;
135# For art.
136allow dumpstate dalvikcache_data_file:dir { search getattr };
137allow dumpstate dalvikcache_data_file:file { r_file_perms execute };
138allow dumpstate dalvikcache_data_file:lnk_file r_file_perms;
139
140# For Bluetooth
141allow dumpstate bluetooth_data_file:dir search;
142allow dumpstate bluetooth_logs_data_file:dir r_dir_perms;
143allow dumpstate bluetooth_logs_data_file:file r_file_perms;
144
145# Dumpstate calls screencap, which grabs a screenshot. Needs gpu access
146allow dumpstate gpu_device:chr_file rw_file_perms;
147
148# logd access
149read_logd(dumpstate)
150control_logd(dumpstate)
151read_runtime_log_tags(dumpstate)
152
153# Read files in /proc
154allow dumpstate proc_meminfo:file r_file_perms;
155allow dumpstate proc_net:file r_file_perms;
156r_dir_file(dumpstate, proc)
157
158# Read network state info files.
159allow dumpstate net_data_file:dir search;
160allow dumpstate net_data_file:file r_file_perms;
161
162# List sockets via ss.
163allow dumpstate self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read };
164
165# Access /data/tombstones.
166allow dumpstate tombstone_data_file:dir r_dir_perms;
167allow dumpstate tombstone_data_file:file r_file_perms;
168
169# Access /cache/recovery
170allow dumpstate cache_recovery_file:dir r_dir_perms;
171allow dumpstate cache_recovery_file:file r_file_perms;
172
173# Access /data/misc/recovery
174allow dumpstate recovery_data_file:dir r_dir_perms;
175allow dumpstate recovery_data_file:file r_file_perms;
176
177# Access /data/misc/profiles/{cur,ref}/
178userdebug_or_eng(`
179  allow dumpstate user_profile_data_file:dir r_dir_perms;
180  allow dumpstate user_profile_data_file:file r_file_perms;
181')
182
183# Access /data/misc/logd
184userdebug_or_eng(`
185  allow dumpstate misc_logd_file:dir r_dir_perms;
186  allow dumpstate misc_logd_file:file r_file_perms;
187')
188
189allow dumpstate { service_manager_type -gatekeeper_service -dumpstate_service -incident_service -virtual_touchpad_service -vr_hwc_service }:service_manager find;
190allow dumpstate servicemanager:service_manager list;
191allow dumpstate hwservicemanager:hwservice_manager list;
192
193allow dumpstate devpts:chr_file rw_file_perms;
194
195# Set properties.
196# dumpstate_prop is used to share state with the Shell app.
197set_prop(dumpstate, dumpstate_prop)
198# dumpstate_options_prop is used to pass extra command-line args.
199set_prop(dumpstate, dumpstate_options_prop)
200
201# Read device's serial number from system properties
202get_prop(dumpstate, serialno_prop)
203
204# Read state of logging-related properties
205get_prop(dumpstate, device_logging_prop)
206
207# Access to /data/media.
208# This should be removed if sdcardfs is modified to alter the secontext for its
209# accesses to the underlying FS.
210allow dumpstate media_rw_data_file:dir getattr;
211allow dumpstate proc_interrupts:file r_file_perms;
212allow dumpstate proc_zoneinfo:file r_file_perms;
213
214# Create a service for talking back to system_server
215add_service(dumpstate, dumpstate_service)
216
217# use /dev/ion for screen capture
218allow dumpstate ion_device:chr_file r_file_perms;
219
220# read default labeled files in /sys
221r_dir_file(dumpstate, sysfs)
222
223# Allow dumpstate to run top
224allow dumpstate proc_stat:file r_file_perms;
225
226# Allow dumpstate to read backlight details
227allow dumpstate sysfs_leds:lnk_file r_file_perms;
228allow dumpstate sysfs_leds:file r_file_perms;
229allow dumpstate sysfs_leds:dir search;
230
231# Allow dumpstate to talk to installd over binder
232binder_call(dumpstate, installd);
233
234# Allow dumpstate to run ip xfrm policy
235allow dumpstate self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_read };
236
237###
238### neverallow rules
239###
240
241# dumpstate has capability sys_ptrace, but should only use that capability for
242# accessing sensitive /proc/PID files, never for using ptrace attach.
243neverallow dumpstate *:process ptrace;
244
245# only system_server, dumpstate and shell can find the dumpstate service
246neverallow { domain -system_server -shell -dumpstate } dumpstate_service:service_manager find;
247
248# Dumpstate should not be writing to any generically labeled sysfs files.
249# Create a specific label for the file type
250neverallow dumpstate sysfs:file no_w_file_perms;
251