xref: /aosp_15_r20/system/sepolicy/prebuilts/api/29.0/public/statsd.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)
1*e4a36f41SAndroid Build Coastguard Workertype statsd, domain, mlstrustedsubject;
2*e4a36f41SAndroid Build Coastguard Worker
3*e4a36f41SAndroid Build Coastguard Workertype statsd_exec, system_file_type, exec_type, file_type;
4*e4a36f41SAndroid Build Coastguard Workerbinder_use(statsd)
5*e4a36f41SAndroid Build Coastguard Worker
6*e4a36f41SAndroid Build Coastguard Worker# Allow statsd to scan through /proc/pid for all processes.
7*e4a36f41SAndroid Build Coastguard Workerr_dir_file(statsd, domain)
8*e4a36f41SAndroid Build Coastguard Worker
9*e4a36f41SAndroid Build Coastguard Worker# Allow executing files on system, such as running a shell or running:
10*e4a36f41SAndroid Build Coastguard Worker#   /system/bin/toolbox
11*e4a36f41SAndroid Build Coastguard Worker#   /system/bin/logcat
12*e4a36f41SAndroid Build Coastguard Worker#   /system/bin/dumpsys
13*e4a36f41SAndroid Build Coastguard Workerallow statsd devpts:chr_file { getattr ioctl read write };
14*e4a36f41SAndroid Build Coastguard Workerallow statsd shell_exec:file rx_file_perms;
15*e4a36f41SAndroid Build Coastguard Workerallow statsd system_file:file execute_no_trans;
16*e4a36f41SAndroid Build Coastguard Workerallow statsd toolbox_exec:file rx_file_perms;
17*e4a36f41SAndroid Build Coastguard Worker
18*e4a36f41SAndroid Build Coastguard Workeruserdebug_or_eng(`
19*e4a36f41SAndroid Build Coastguard Worker  allow statsd su:fifo_file read;
20*e4a36f41SAndroid Build Coastguard Worker')
21*e4a36f41SAndroid Build Coastguard Worker
22*e4a36f41SAndroid Build Coastguard Worker# Create, read, and write into /data/misc/stats-data, /data/misc/stats-system.
23*e4a36f41SAndroid Build Coastguard Workerallow statsd stats_data_file:dir create_dir_perms;
24*e4a36f41SAndroid Build Coastguard Workerallow statsd stats_data_file:file create_file_perms;
25*e4a36f41SAndroid Build Coastguard Worker
26*e4a36f41SAndroid Build Coastguard Worker# Allow statsd to make binder calls to any binder service.
27*e4a36f41SAndroid Build Coastguard Workerbinder_call(statsd, appdomain)
28*e4a36f41SAndroid Build Coastguard Workerbinder_call(statsd, healthd)
29*e4a36f41SAndroid Build Coastguard Workerbinder_call(statsd, incidentd)
30*e4a36f41SAndroid Build Coastguard Workeruserdebug_or_eng(`
31*e4a36f41SAndroid Build Coastguard Worker  binder_call(statsd, perfprofd)
32*e4a36f41SAndroid Build Coastguard Worker')
33*e4a36f41SAndroid Build Coastguard Workerbinder_call(statsd, system_server)
34*e4a36f41SAndroid Build Coastguard Worker
35*e4a36f41SAndroid Build Coastguard Worker# Allow statsd to interact with gpuservice
36*e4a36f41SAndroid Build Coastguard Workerallow statsd gpu_service:service_manager find;
37*e4a36f41SAndroid Build Coastguard Workerbinder_call(statsd, gpuservice)
38*e4a36f41SAndroid Build Coastguard Worker
39*e4a36f41SAndroid Build Coastguard Worker# Allow logd access.
40*e4a36f41SAndroid Build Coastguard Workerread_logd(statsd)
41*e4a36f41SAndroid Build Coastguard Workercontrol_logd(statsd)
42*e4a36f41SAndroid Build Coastguard Worker
43*e4a36f41SAndroid Build Coastguard Worker# Grant statsd with permissions to register the services.
44*e4a36f41SAndroid Build Coastguard Workerallow statsd {
45*e4a36f41SAndroid Build Coastguard Worker  app_api_service
46*e4a36f41SAndroid Build Coastguard Worker  incident_service
47*e4a36f41SAndroid Build Coastguard Worker  userdebug_or_eng(`
48*e4a36f41SAndroid Build Coastguard Worker    perfprofd_service
49*e4a36f41SAndroid Build Coastguard Worker  ')
50*e4a36f41SAndroid Build Coastguard Worker  system_api_service
51*e4a36f41SAndroid Build Coastguard Worker}:service_manager find;
52*e4a36f41SAndroid Build Coastguard Worker
53*e4a36f41SAndroid Build Coastguard Worker# Grant statsd to access health hal to access battery metrics.
54*e4a36f41SAndroid Build Coastguard Workerallow statsd hal_health_hwservice:hwservice_manager find;
55*e4a36f41SAndroid Build Coastguard Worker
56*e4a36f41SAndroid Build Coastguard Worker# Allow statsd to send dump info to dumpstate
57*e4a36f41SAndroid Build Coastguard Workerallow statsd dumpstate:fd use;
58*e4a36f41SAndroid Build Coastguard Workerallow statsd dumpstate:fifo_file { getattr write };
59*e4a36f41SAndroid Build Coastguard Worker
60*e4a36f41SAndroid Build Coastguard Worker# Allow access to with hardware layer and process stats.
61*e4a36f41SAndroid Build Coastguard Workerallow statsd proc_uid_cputime_showstat:file { getattr open read };
62*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(statsd, hal_health)
63*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(statsd, hal_power)
64*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(statsd, hal_power_stats)
65*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(statsd, hal_thermal)
66*e4a36f41SAndroid Build Coastguard Worker
67*e4a36f41SAndroid Build Coastguard Worker# Allow 'adb shell cmd' to upload configs and download output.
68*e4a36f41SAndroid Build Coastguard Workerallow statsd adbd:fd use;
69*e4a36f41SAndroid Build Coastguard Workerallow statsd adbd:unix_stream_socket { getattr read write };
70*e4a36f41SAndroid Build Coastguard Workerallow statsd shell:fifo_file { getattr read write };
71*e4a36f41SAndroid Build Coastguard Worker
72*e4a36f41SAndroid Build Coastguard Workerunix_socket_send(statsd, statsdw, statsd)
73*e4a36f41SAndroid Build Coastguard Worker
74*e4a36f41SAndroid Build Coastguard Worker###
75*e4a36f41SAndroid Build Coastguard Worker### neverallow rules
76*e4a36f41SAndroid Build Coastguard Worker###
77*e4a36f41SAndroid Build Coastguard Worker
78*e4a36f41SAndroid Build Coastguard Worker# Only statsd and the other root services in limited circumstances.
79*e4a36f41SAndroid Build Coastguard Worker# can get to the files in /data/misc/stats-data, /data/misc/stats-service.
80*e4a36f41SAndroid Build Coastguard Worker# Other services are prohibitted from accessing the file.
81*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -statsd -system_server -init -vold } stats_data_file:file *;
82*e4a36f41SAndroid Build Coastguard Worker
83*e4a36f41SAndroid Build Coastguard Worker# Limited access to the directory itself.
84*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -statsd -system_server -init -vold } stats_data_file:dir *;
85