1# Perfetto tracing probes, has tracefs access. 2type traced_probes_exec, system_file_type, exec_type, file_type; 3type traced_probes_tmpfs, file_type; 4 5# Allow init to exec the daemon. 6init_daemon_domain(traced_probes) 7tmpfs_domain(traced_probes) 8 9# Write trace data to the Perfetto traced damon. This requires connecting to its 10# producer socket and obtaining a (per-process) tmpfs fd. 11perfetto_producer(traced_probes) 12 13# Allow traced_probes to access tracefs. 14allow traced_probes debugfs_tracing:dir r_dir_perms; 15allow traced_probes debugfs_tracing:file rw_file_perms; 16allow traced_probes debugfs_trace_marker:file getattr; 17allow traced_probes debugfs_tracing_printk_formats:file r_file_perms; 18 19# Allow traced_probes to access mm_events trace instance 20allow traced_probes debugfs_tracing_instances:dir search; 21allow traced_probes debugfs_mm_events_tracing:dir search; 22allow traced_probes debugfs_mm_events_tracing:file rw_file_perms; 23 24# TODO(primiano): temporarily I/O tracing categories are still 25# userdebug only until we nail down the denylist/allowlist. 26userdebug_or_eng(` 27allow traced_probes debugfs_tracing_debug:dir r_dir_perms; 28allow traced_probes debugfs_tracing_debug:file rw_file_perms; 29') 30 31# Allow traced_probes to start with a higher scheduling class and then downgrade 32# itself. 33allow traced_probes self:global_capability_class_set { sys_nice }; 34 35# Allow procfs access 36r_dir_file(traced_probes, domain) 37 38# Allow to temporarily lift the kptr_restrict setting and build a symbolization 39# map reading /proc/kallsyms. 40userdebug_or_eng(`set_prop(traced_probes, lower_kptr_restrict_prop)') 41allow traced_probes proc_kallsyms:file r_file_perms; 42 43# Allow to read packages.list file. 44allow traced_probes packages_list_file:file r_file_perms; 45 46# Allow to read game_mode_intervention.list file. 47allow traced_probes game_mode_intervention_list_file:file r_file_perms; 48 49# Allow to log to kernel dmesg when starting / stopping ftrace. 50allow traced_probes kmsg_device:chr_file write; 51 52# Allow traced_probes to list the system partition. 53allow traced_probes system_file:dir { open read }; 54 55# Allow traced_probes to list some of the data partition. 56allow traced_probes self:global_capability_class_set dac_read_search; 57 58allow traced_probes apk_data_file:dir { getattr open read search }; 59allow traced_probes { apex_art_data_file apex_module_data_file }:dir { getattr open read search }; 60allow traced_probes dalvikcache_data_file:dir { getattr open read search }; 61userdebug_or_eng(` 62# search and getattr are granted via domain and coredomain, respectively. 63allow traced_probes system_data_file:dir { open read }; 64') 65allow traced_probes system_app_data_file:dir { getattr open read search }; 66allow traced_probes backup_data_file:dir { getattr open read search }; 67allow traced_probes bootstat_data_file:dir { getattr open read search }; 68allow traced_probes update_engine_data_file:dir { getattr open read search }; 69allow traced_probes update_engine_log_data_file:dir { getattr open read search }; 70allow traced_probes { user_profile_root_file user_profile_data_file}:dir { getattr open read search }; 71 72# Allow traced_probes to run atrace. atrace pokes at system services to enable 73# their userspace TRACE macros. 74domain_auto_trans(traced_probes, atrace_exec, atrace); 75 76# Allow traced_probes to kill atrace on timeout. 77allow traced_probes atrace:process sigkill; 78 79# Allow traced_probes to access /proc files for system stats. 80# Note: trace data is NOT exposed to anything other than shell and privileged 81# system apps that have access to the traced consumer socket. 82allow traced_probes { 83 proc_meminfo 84 proc_vmstat 85 proc_stat 86}:file r_file_perms; 87 88# Allow access to read /sys/class/devfreq/ and /$DEVICE/cur_freq files 89allow traced_probes sysfs_devfreq_dir:dir r_dir_perms; 90allow traced_probes sysfs_devfreq_cur:file r_file_perms; 91 92# Allow access to the IHealth and IPowerStats HAL service for tracing battery counters. 93hal_client_domain(traced_probes, hal_health) 94hal_client_domain(traced_probes, hal_power_stats) 95 96# Allow access to Atrace HAL for enabling vendor/device specific tracing categories. 97hal_client_domain(traced_probes, hal_atrace) 98 99# On debug builds allow to ingest system logs into the trace. 100userdebug_or_eng(`read_logd(traced_probes)') 101 102# Allow traced_probes to talk to statsd for logging metrics. 103unix_socket_send(traced_probes, statsdw, statsd) 104 105### 106### Neverallow rules 107### 108### traced_probes should NEVER do any of this 109 110# Disallow mapping executable memory (execstack and exec are already disallowed 111# globally in domain.te). 112neverallow traced_probes self:process execmem; 113 114# Block device access. 115neverallow traced_probes dev_type:blk_file { read write }; 116 117# ptrace any other app 118neverallow traced_probes domain:process ptrace; 119 120# Disallows access to /data files. 121neverallow traced_probes { 122 data_file_type 123 -apex_module_data_file 124 -apex_art_data_file 125 -apk_data_file 126 -dalvikcache_data_file 127 -system_data_file 128 -system_data_root_file 129 -system_app_data_file 130 -backup_data_file 131 -bootstat_data_file 132 -update_engine_data_file 133 -update_engine_log_data_file 134 -user_profile_root_file 135 -user_profile_data_file 136 # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a 137 # subsequent neverallow. Currently only getattr and search are allowed. 138 -vendor_data_file 139 -zoneinfo_data_file 140 with_native_coverage(`-method_trace_data_file') 141}:dir *; 142neverallow traced_probes system_data_file:dir ~{ getattr userdebug_or_eng(`open read') search }; 143neverallow traced_probes zoneinfo_data_file:dir ~r_dir_perms; 144neverallow traced_probes { data_file_type -zoneinfo_data_file }:lnk_file *; 145neverallow traced_probes { 146 data_file_type 147 -zoneinfo_data_file 148 -packages_list_file 149 with_native_coverage(`-method_trace_data_file') 150 -game_mode_intervention_list_file 151}:file *; 152 153# Only init is allowed to enter the traced_probes domain via exec() 154neverallow { domain -init } traced_probes:process transition; 155neverallow * traced_probes:process dyntransition; 156 157