1typeattribute dumpstate coredomain; 2type dumpstate_tmpfs, file_type; 3 4init_daemon_domain(dumpstate) 5 6# Execute and transition to the vdc domain 7domain_auto_trans(dumpstate, vdc_exec, vdc) 8 9# Create tmpfs files for using memfd descriptors to get output from child 10# processes. 11tmpfs_domain(dumpstate) 12 13# Acquire advisory lock on /system/etc/xtables.lock from ip[6]tables 14allow dumpstate system_file:file lock; 15 16allow dumpstate storaged_exec:file rx_file_perms; 17 18# /data/misc/a11ytrace for accessibility traces 19userdebug_or_eng(` 20 allow dumpstate accessibility_trace_data_file:dir r_dir_perms; 21 allow dumpstate accessibility_trace_data_file:file r_file_perms; 22') 23 24# /data/misc/wmtrace for wm traces 25userdebug_or_eng(` 26 allow dumpstate wm_trace_data_file:dir r_dir_perms; 27 allow dumpstate wm_trace_data_file:file r_file_perms; 28') 29 30# /data/system/dropbox for dropbox entries 31userdebug_or_eng(` 32 allow dumpstate dropbox_data_file:dir r_dir_perms; 33 allow dumpstate dropbox_data_file:file r_file_perms; 34') 35 36# Allow dumpstate to make binder calls to incidentd 37binder_call(dumpstate, incidentd) 38 39# Kill incident in case of a timeout 40allow dumpstate incident:process { signal sigkill }; 41 42# Allow dumpstate to make binder calls to storaged service 43binder_call(dumpstate, storaged) 44 45# Allow dumpstate to make binder calls to statsd 46binder_call(dumpstate, statsd) 47 48# Allow dumpstate to talk to gpuservice over binder 49binder_call(dumpstate, gpuservice); 50 51# Allow dumpstate to talk to idmap over binder 52binder_call(dumpstate, idmap); 53 54# Allow dumpstate to talk to profcollectd over binder 55userdebug_or_eng(` 56 binder_call(dumpstate, profcollectd) 57') 58 59# Allow dumpstate to talk to automotive_display_service over binder 60binder_call(dumpstate, automotive_display_service) 61 62# Allow dumpstate to talk to virtual_camera service over binder 63binder_call(dumpstate, virtual_camera) 64 65# Allow dumpstate to talk to ot_daemon service over binder 66binder_call(dumpstate, ot_daemon) 67 68# Collect metrics on boot time created by init 69get_prop(dumpstate, boottime_prop) 70 71get_prop(dumpstate, misctrl_prop) 72 73# Signal native processes to dump their stack. 74allow dumpstate { 75 mediatranscoding 76 statsd 77 netd 78 virtual_camera 79 ot_daemon 80}:process signal; 81 82# Only allow dumpstate to dump Keystore on debuggable builds. 83userdebug_or_eng(` 84 allow dumpstate keystore:process signal; 85') 86dontaudit dumpstate keystore:process { signal }; 87 88# For collecting bugreports. 89no_debugfs_restriction(` 90 allow dumpstate debugfs_wakeup_sources:file r_file_perms; 91') 92 93allow dumpstate dev_type:blk_file getattr; 94allow dumpstate webview_zygote:process signal; 95allow dumpstate sysfs_dmabuf_stats:file r_file_perms; 96dontaudit dumpstate update_engine:binder call; 97 98# Read files in /proc 99allow dumpstate { 100 config_gz 101 proc_net_tcp_udp 102 proc_pid_max 103}:file r_file_perms; 104 105# For comminucating with the system process to do confirmation ui. 106binder_call(dumpstate, incidentcompanion_service) 107 108# Set properties. 109# dumpstate_prop is used to share state with the Shell app. 110set_prop(dumpstate, dumpstate_prop) 111set_prop(dumpstate, exported_dumpstate_prop) 112 113# dumpstate_options_prop is used to pass extra command-line args. 114set_prop(dumpstate, dumpstate_options_prop) 115 116# Allow dumpstate to kill vendor dumpstate service by init 117set_prop(dumpstate, ctl_dumpstate_prop) 118 119# For dumping dynamic partition information. 120set_prop(dumpstate, lpdumpd_prop) 121binder_call(dumpstate, lpdumpd) 122 123# For dumping hypervisor information. 124get_prop(dumpstate, hypervisor_prop) 125 126# For dumping device-mapper and snapshot information. 127allow dumpstate gsid_exec:file rx_file_perms; 128set_prop(dumpstate, ctl_gsid_prop) 129binder_call(dumpstate, gsid) 130 131r_dir_file(dumpstate, ota_metadata_file) 132 133# For starting (and killing) perfetto --save-for-bugreport. If a labelled trace 134# is being recorded, the command above will serialize it into 135# /data/misc/perfetto-traces/bugreport/*.pftrace . 136domain_auto_trans(dumpstate, perfetto_exec, perfetto) 137allow dumpstate perfetto:process signal; 138allow dumpstate perfetto_traces_data_file:dir { search }; 139allow dumpstate perfetto_traces_bugreport_data_file:dir rw_dir_perms; 140allow dumpstate perfetto_traces_bugreport_data_file:file { r_file_perms unlink }; 141 142# When exec-ing /system/bin/perfetto, dumpstates redirects stdio to /dev/null 143# (which is labelled as dumpstate_tmpfs) to avoid leaking a FD to the bugreport 144# zip file. These rules are to allow perfetto.te to inherit dumpstate's 145# /dev/null. 146allow perfetto dumpstate_tmpfs:file rw_file_perms; 147allow perfetto dumpstate:fd use; 148 149# system_dlkm_file for /system_dlkm partition 150allow dumpstate system_dlkm_file:dir getattr; 151 152# Allow dumpstate to execute derive_sdk in its own domain 153domain_auto_trans(dumpstate, derive_sdk_exec, derive_sdk) 154