1typeattribute dumpstate coredomain; 2type dumpstate_tmpfs, file_type; 3 4init_daemon_domain(dumpstate) 5 6# Execute and transition to the vdc domain 7domain_auto_trans(dumpstate, vdc_exec, vdc) 8 9# Create tmpfs files for using memfd descriptors to get output from child 10# processes. 11tmpfs_domain(dumpstate) 12 13# Acquire advisory lock on /system/etc/xtables.lock from ip[6]tables 14allow dumpstate system_file:file lock; 15 16allow dumpstate storaged_exec:file rx_file_perms; 17 18# /data/misc/a11ytrace for accessibility traces 19userdebug_or_eng(` 20 allow dumpstate accessibility_trace_data_file:dir r_dir_perms; 21 allow dumpstate accessibility_trace_data_file:file r_file_perms; 22') 23 24# /data/misc/wmtrace for wm traces 25userdebug_or_eng(` 26 allow dumpstate wm_trace_data_file:dir r_dir_perms; 27 allow dumpstate wm_trace_data_file:file r_file_perms; 28') 29 30# Allow dumpstate to make binder calls to incidentd 31binder_call(dumpstate, incidentd) 32 33# Allow dumpstate to make binder calls to storaged service 34binder_call(dumpstate, storaged) 35 36# Allow dumpstate to make binder calls to statsd 37binder_call(dumpstate, statsd) 38 39# Allow dumpstate to talk to gpuservice over binder 40binder_call(dumpstate, gpuservice); 41 42# Allow dumpstate to talk to idmap over binder 43binder_call(dumpstate, idmap); 44 45# Allow dumpstate to talk to profcollectd over binder 46userdebug_or_eng(` 47 binder_call(dumpstate, profcollectd) 48') 49 50# Collect metrics on boot time created by init 51get_prop(dumpstate, boottime_prop) 52 53# Signal native processes to dump their stack. 54allow dumpstate { 55 mediatranscoding 56 statsd 57 netd 58}:process signal; 59 60userdebug_or_eng(` 61 allow dumpstate keystore:process signal; 62') 63 64# For collecting bugreports. 65no_debugfs_restriction(` 66 allow dumpstate debugfs_wakeup_sources:file r_file_perms; 67') 68 69allow dumpstate dev_type:blk_file getattr; 70allow dumpstate webview_zygote:process signal; 71allow dumpstate sysfs_dmabuf_stats:file r_file_perms; 72dontaudit dumpstate update_engine:binder call; 73 74# Read files in /proc 75allow dumpstate { 76 proc_net_tcp_udp 77 proc_pid_max 78}:file r_file_perms; 79 80# For comminucating with the system process to do confirmation ui. 81binder_call(dumpstate, incidentcompanion_service) 82 83# Set properties. 84# dumpstate_prop is used to share state with the Shell app. 85set_prop(dumpstate, dumpstate_prop) 86set_prop(dumpstate, exported_dumpstate_prop) 87 88# dumpstate_options_prop is used to pass extra command-line args. 89set_prop(dumpstate, dumpstate_options_prop) 90 91# Allow dumpstate to kill vendor dumpstate service by init 92set_prop(dumpstate, ctl_dumpstate_prop) 93 94# For dumping dynamic partition information. 95set_prop(dumpstate, lpdumpd_prop) 96binder_call(dumpstate, lpdumpd) 97 98# For dumping hypervisor information. 99get_prop(dumpstate, hypervisor_prop) 100 101# For dumping device-mapper and snapshot information. 102allow dumpstate gsid_exec:file rx_file_perms; 103set_prop(dumpstate, ctl_gsid_prop) 104binder_call(dumpstate, gsid) 105 106r_dir_file(dumpstate, ota_metadata_file) 107 108# For starting (and killing) perfetto --save-for-bugreport. If a labelled trace 109# is being recorded, the command above will serialize it into 110# /data/misc/perfetto-traces/bugreport/*.pftrace . 111domain_auto_trans(dumpstate, perfetto_exec, perfetto) 112allow dumpstate perfetto:process signal; 113allow dumpstate perfetto_traces_data_file:dir { search }; 114allow dumpstate perfetto_traces_bugreport_data_file:dir rw_dir_perms; 115allow dumpstate perfetto_traces_bugreport_data_file:file { r_file_perms unlink }; 116 117# When exec-ing /system/bin/perfetto, dumpstates redirects stdio to /dev/null 118# (which is labelled as dumpstate_tmpfs) to avoid leaking a FD to the bugreport 119# zip file. These rules are to allow perfetto.te to inherit dumpstate's 120# /dev/null. 121allow perfetto dumpstate_tmpfs:file rw_file_perms; 122allow perfetto dumpstate:fd use; 123 124# system_dlkm_file for /system_dlkm partition 125allow dumpstate system_dlkm_file:dir getattr; 126