1*e4a36f41SAndroid Build Coastguard Workertype statsd, domain, mlstrustedsubject; 2*e4a36f41SAndroid Build Coastguard Worker 3*e4a36f41SAndroid Build Coastguard Workertype statsd_exec, system_file_type, exec_type, file_type; 4*e4a36f41SAndroid Build Coastguard Workerbinder_use(statsd) 5*e4a36f41SAndroid Build Coastguard Worker 6*e4a36f41SAndroid Build Coastguard Worker# Allow statsd to scan through /proc/pid for all processes. 7*e4a36f41SAndroid Build Coastguard Workerr_dir_file(statsd, domain) 8*e4a36f41SAndroid Build Coastguard Worker 9*e4a36f41SAndroid Build Coastguard Worker# Allow executing files on system, such as running a shell or running: 10*e4a36f41SAndroid Build Coastguard Worker# /system/bin/toolbox 11*e4a36f41SAndroid Build Coastguard Worker# /system/bin/logcat 12*e4a36f41SAndroid Build Coastguard Worker# /system/bin/dumpsys 13*e4a36f41SAndroid Build Coastguard Workerallow statsd devpts:chr_file { getattr ioctl read write }; 14*e4a36f41SAndroid Build Coastguard Workerallow statsd shell_exec:file rx_file_perms; 15*e4a36f41SAndroid Build Coastguard Workerallow statsd system_file:file execute_no_trans; 16*e4a36f41SAndroid Build Coastguard Workerallow statsd toolbox_exec:file rx_file_perms; 17*e4a36f41SAndroid Build Coastguard Worker 18*e4a36f41SAndroid Build Coastguard Workeruserdebug_or_eng(` 19*e4a36f41SAndroid Build Coastguard Worker allow statsd su:fifo_file read; 20*e4a36f41SAndroid Build Coastguard Worker') 21*e4a36f41SAndroid Build Coastguard Worker 22*e4a36f41SAndroid Build Coastguard Worker# Create, read, and write into /data/misc/stats-data, /data/misc/stats-system. 23*e4a36f41SAndroid Build Coastguard Workerallow statsd stats_data_file:dir create_dir_perms; 24*e4a36f41SAndroid Build Coastguard Workerallow statsd stats_data_file:file create_file_perms; 25*e4a36f41SAndroid Build Coastguard Worker 26*e4a36f41SAndroid Build Coastguard Worker# Allow statsd to make binder calls to any binder service. 27*e4a36f41SAndroid Build Coastguard Workerbinder_call(statsd, appdomain) 28*e4a36f41SAndroid Build Coastguard Workerbinder_call(statsd, healthd) 29*e4a36f41SAndroid Build Coastguard Workerbinder_call(statsd, incidentd) 30*e4a36f41SAndroid Build Coastguard Workerbinder_call(statsd, system_server) 31*e4a36f41SAndroid Build Coastguard Worker 32*e4a36f41SAndroid Build Coastguard Worker# Allow statsd to interact with gpuservice 33*e4a36f41SAndroid Build Coastguard Workerallow statsd gpu_service:service_manager find; 34*e4a36f41SAndroid Build Coastguard Workerbinder_call(statsd, gpuservice) 35*e4a36f41SAndroid Build Coastguard Worker 36*e4a36f41SAndroid Build Coastguard Worker# Allow logd access. 37*e4a36f41SAndroid Build Coastguard Workerread_logd(statsd) 38*e4a36f41SAndroid Build Coastguard Workercontrol_logd(statsd) 39*e4a36f41SAndroid Build Coastguard Worker 40*e4a36f41SAndroid Build Coastguard Worker# Grant statsd with permissions to register the services. 41*e4a36f41SAndroid Build Coastguard Workerallow statsd { 42*e4a36f41SAndroid Build Coastguard Worker app_api_service 43*e4a36f41SAndroid Build Coastguard Worker incident_service 44*e4a36f41SAndroid Build Coastguard Worker system_api_service 45*e4a36f41SAndroid Build Coastguard Worker}:service_manager find; 46*e4a36f41SAndroid Build Coastguard Worker 47*e4a36f41SAndroid Build Coastguard Worker# Grant statsd to access health hal to access battery metrics. 48*e4a36f41SAndroid Build Coastguard Workerallow statsd hal_health_hwservice:hwservice_manager find; 49*e4a36f41SAndroid Build Coastguard Worker 50*e4a36f41SAndroid Build Coastguard Worker# Allow statsd to send dump info to dumpstate 51*e4a36f41SAndroid Build Coastguard Workerallow statsd dumpstate:fd use; 52*e4a36f41SAndroid Build Coastguard Workerallow statsd dumpstate:fifo_file { getattr write }; 53*e4a36f41SAndroid Build Coastguard Worker 54*e4a36f41SAndroid Build Coastguard Worker# Allow access to with hardware layer and process stats. 55*e4a36f41SAndroid Build Coastguard Workerallow statsd proc_uid_cputime_showstat:file { getattr open read }; 56*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(statsd, hal_health) 57*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(statsd, hal_power) 58*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(statsd, hal_power_stats) 59*e4a36f41SAndroid Build Coastguard Workerhal_client_domain(statsd, hal_thermal) 60*e4a36f41SAndroid Build Coastguard Worker 61*e4a36f41SAndroid Build Coastguard Worker# Allow 'adb shell cmd' to upload configs and download output. 62*e4a36f41SAndroid Build Coastguard Workerallow statsd adbd:fd use; 63*e4a36f41SAndroid Build Coastguard Workerallow statsd adbd:unix_stream_socket { getattr read write }; 64*e4a36f41SAndroid Build Coastguard Workerallow statsd shell:fifo_file { getattr read write }; 65*e4a36f41SAndroid Build Coastguard Worker 66*e4a36f41SAndroid Build Coastguard Workerunix_socket_send(statsd, statsdw, statsd) 67*e4a36f41SAndroid Build Coastguard Worker 68*e4a36f41SAndroid Build Coastguard Worker### 69*e4a36f41SAndroid Build Coastguard Worker### neverallow rules 70*e4a36f41SAndroid Build Coastguard Worker### 71*e4a36f41SAndroid Build Coastguard Worker 72*e4a36f41SAndroid Build Coastguard Worker# Only statsd and the other root services in limited circumstances. 73*e4a36f41SAndroid Build Coastguard Worker# can get to the files in /data/misc/stats-data, /data/misc/stats-service. 74*e4a36f41SAndroid Build Coastguard Worker# Other services are prohibitted from accessing the file. 75*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -statsd -system_server -init -vold } stats_data_file:file *; 76*e4a36f41SAndroid Build Coastguard Worker 77*e4a36f41SAndroid Build Coastguard Worker# Limited access to the directory itself. 78*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -statsd -system_server -init -vold } stats_data_file:dir *; 79