xref: /aosp_15_r20/system/sepolicy/prebuilts/api/202404/private/bootstat.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290) 
1typeattribute bootstat coredomain;
2
3init_daemon_domain(bootstat)
4
5# Collect metrics on boot time created by init
6get_prop(bootstat, boottime_prop)
7
8# Read/Write [persist.]sys.boot.reason and ro.boot.bootreason (write if empty)
9set_prop(bootstat, bootloader_boot_reason_prop)
10set_prop(bootstat, system_boot_reason_prop)
11set_prop(bootstat, last_boot_reason_prop)
12
13neverallow {
14  domain
15  -bootanim
16  -bootstat
17  -dumpstate
18  userdebug_or_eng(`-incidentd')
19  -init
20  -platform_app
21  -recovery
22  -shell
23  -system_server
24} { bootloader_boot_reason_prop last_boot_reason_prop }:file r_file_perms;
25# ... and refine, as these components should not set the last boot reason
26neverallow { bootanim recovery } last_boot_reason_prop:file r_file_perms;
27
28neverallow {
29  domain
30  -bootstat
31  -init
32  -system_server
33} { bootloader_boot_reason_prop last_boot_reason_prop }:property_service set;
34# ... and refine ... for a ro propertly no less ... keep this _tight_
35neverallow system_server bootloader_boot_reason_prop:property_service set;
36