1# Perfetto command-line client. Can be used only from the domains that are
2# explicitly whitelisted with a domain_auto_trans(X, perfetto_exec, perfetto).
3# This command line client accesses the privileged socket of the traced
4# daemon.
5
6type perfetto, domain, coredomain;
7type perfetto_exec, exec_type, file_type;
8
9tmpfs_domain(perfetto);
10
11# Allow to access traced's privileged consumer socket.
12unix_socket_connect(perfetto, traced_consumer, traced)
13
14# Allow to write and unlink traces into /data/misc/perfetto-traces.
15allow perfetto perfetto_traces_data_file:dir rw_dir_perms;
16allow perfetto perfetto_traces_data_file:file create_file_perms;
17
18# Allow to access binder to pass the traces to Dropbox.
19binder_use(perfetto)
20binder_call(perfetto, system_server)
21allow perfetto dropbox_service:service_manager find;
22
23# Allow statsd and shell to pipe the trace config to perfetto on stdin and to
24# print out on stdout/stderr.
25allow perfetto statsd:fd use;
26allow perfetto statsd:fifo_file { getattr read write };
27allow perfetto shell:fd use;
28allow perfetto shell:fifo_file { getattr read write };
29
30# Allow to communicate use, read and write over the adb connection.
31allow perfetto adbd:fd use;
32allow perfetto adbd:unix_stream_socket { read write };
33
34# allow adbd to reap perfetto
35allow perfetto adbd:process { sigchld };
36
37# Allow to access /dev/pts when launched in an adb shell.
38allow perfetto devpts:chr_file rw_file_perms;
39
40###
41### Neverallow rules
42###
43### perfetto should NEVER do any of this
44
45# Disallow mapping executable memory (execstack and exec are already disallowed
46# globally in domain.te).
47neverallow perfetto self:process execmem;
48
49# Block device access.
50neverallow perfetto dev_type:blk_file { read write };
51
52# ptrace any other process
53neverallow perfetto domain:process ptrace;
54
55# Disallows access to other /data files.
56neverallow perfetto {
57  data_file_type
58  -system_data_file
59  # TODO(b/72998741) Remove exemption. Further restricted in a subsequent
60  # neverallow. Currently only getattr and search are allowed.
61  -vendor_data_file
62  -zoneinfo_data_file
63  -perfetto_traces_data_file
64}:dir *;
65neverallow perfetto { system_data_file -perfetto_traces_data_file }:dir ~{ getattr search };
66neverallow perfetto zoneinfo_data_file:dir ~r_dir_perms;
67neverallow perfetto { data_file_type -zoneinfo_data_file -perfetto_traces_data_file }:lnk_file *;
68neverallow perfetto { data_file_type -zoneinfo_data_file -perfetto_traces_data_file }:file ~write;
69