xref: /aosp_15_r20/system/sepolicy/prebuilts/api/29.0/private/incident.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)
1*e4a36f41SAndroid Build Coastguard Workertypeattribute incident coredomain;
2*e4a36f41SAndroid Build Coastguard Worker
3*e4a36f41SAndroid Build Coastguard Workertype incident_exec, system_file_type, exec_type, file_type;
4*e4a36f41SAndroid Build Coastguard Worker
5*e4a36f41SAndroid Build Coastguard Worker# switch to incident domain for incident command
6*e4a36f41SAndroid Build Coastguard Workerdomain_auto_trans(shell, incident_exec, incident)
7*e4a36f41SAndroid Build Coastguard Worker
8*e4a36f41SAndroid Build Coastguard Worker# allow incident access to stdout from its parent shell.
9*e4a36f41SAndroid Build Coastguard Workerallow incident shell:fd use;
10*e4a36f41SAndroid Build Coastguard Worker
11*e4a36f41SAndroid Build Coastguard Worker# allow incident be able to output data for CTS to fetch.
12*e4a36f41SAndroid Build Coastguard Workerallow incident devpts:chr_file { read write };
13*e4a36f41SAndroid Build Coastguard Worker
14*e4a36f41SAndroid Build Coastguard Worker# allow incident to communicate use, read and write over the adb
15*e4a36f41SAndroid Build Coastguard Worker# connection.
16*e4a36f41SAndroid Build Coastguard Workerallow incident adbd:fd use;
17*e4a36f41SAndroid Build Coastguard Workerallow incident adbd:unix_stream_socket { read write };
18*e4a36f41SAndroid Build Coastguard Worker
19*e4a36f41SAndroid Build Coastguard Worker# allow adbd to reap incident
20*e4a36f41SAndroid Build Coastguard Workerallow incident adbd:process { sigchld };
21*e4a36f41SAndroid Build Coastguard Worker
22*e4a36f41SAndroid Build Coastguard Worker# Allow the incident command to talk to the incidentd over the binder, and get
23*e4a36f41SAndroid Build Coastguard Worker# back the incident report data from a ParcelFileDescriptor.
24*e4a36f41SAndroid Build Coastguard Workerbinder_use(incident)
25*e4a36f41SAndroid Build Coastguard Workerallow incident incident_service:service_manager find;
26*e4a36f41SAndroid Build Coastguard Workerbinder_call(incident, incidentd)
27*e4a36f41SAndroid Build Coastguard Workerallow incident incidentd:fifo_file write;
28*e4a36f41SAndroid Build Coastguard Worker
29*e4a36f41SAndroid Build Coastguard Worker# only allow incident being called by shell
30*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -su -shell -incident } incident_exec:file { execute execute_no_trans };
31