1# Perfetto tracing probes, has tracefs access. 2type traced_probes_exec, system_file_type, exec_type, file_type; 3type traced_probes_tmpfs, file_type; 4 5# Allow init to exec the daemon. 6init_daemon_domain(traced_probes) 7tmpfs_domain(traced_probes) 8 9# Write trace data to the Perfetto traced damon. This requires connecting to its 10# producer socket and obtaining a (per-process) tmpfs fd. 11perfetto_producer(traced_probes) 12 13# Allow traced_probes to access tracefs. 14allow traced_probes debugfs_tracing:dir r_dir_perms; 15allow traced_probes debugfs_tracing:file rw_file_perms; 16allow traced_probes debugfs_trace_marker:file getattr; 17allow traced_probes debugfs_tracing_printk_formats:file r_file_perms; 18 19# Allow traced_probes to access mm_events trace instance 20allow traced_probes debugfs_tracing_instances:dir search; 21allow traced_probes debugfs_mm_events_tracing:dir search; 22allow traced_probes debugfs_mm_events_tracing:file rw_file_perms; 23 24# TODO(primiano): temporarily I/O tracing categories are still 25# userdebug only until we nail down the denylist/allowlist. 26userdebug_or_eng(` 27allow traced_probes debugfs_tracing_debug:dir r_dir_perms; 28allow traced_probes debugfs_tracing_debug:file rw_file_perms; 29') 30 31# Allow traced_probes to start with a higher scheduling class and then downgrade 32# itself. 33allow traced_probes self:global_capability_class_set { sys_nice }; 34 35# Allow procfs access 36r_dir_file(traced_probes, domain) 37 38# Allow to temporarily lift the kptr_restrict setting and build a symbolization 39# map reading /proc/kallsyms. 40userdebug_or_eng(`set_prop(traced_probes, lower_kptr_restrict_prop)') 41allow traced_probes proc_kallsyms:file r_file_perms; 42 43# Allow to read packages.list file. 44allow traced_probes packages_list_file:file r_file_perms; 45 46# Allow to read game_mode_intervention.list file. 47allow traced_probes game_mode_intervention_list_file:file r_file_perms; 48 49# Allow to log to kernel dmesg when starting / stopping ftrace. 50allow traced_probes kmsg_device:chr_file write; 51 52# Allow traced_probes to list the system partition. 53allow traced_probes system_file:dir { open read }; 54 55# Allow traced_probes to list some of the data partition. 56allow traced_probes self:global_capability_class_set dac_read_search; 57 58allow traced_probes apk_data_file:dir { getattr open read search }; 59allow traced_probes { apex_art_data_file apex_module_data_file }:dir { getattr open read search }; 60allow traced_probes dalvikcache_data_file:dir { getattr open read search }; 61userdebug_or_eng(` 62# search and getattr are granted via domain and coredomain, respectively. 63allow traced_probes system_data_file:dir { open read }; 64') 65allow traced_probes system_app_data_file:dir { getattr open read search }; 66allow traced_probes backup_data_file:dir { getattr open read search }; 67allow traced_probes bootstat_data_file:dir { getattr open read search }; 68allow traced_probes update_engine_data_file:dir { getattr open read search }; 69allow traced_probes update_engine_log_data_file:dir { getattr open read search }; 70allow traced_probes { user_profile_root_file user_profile_data_file}:dir { getattr open read search }; 71 72# Allow traced_probes to run atrace. atrace pokes at system services to enable 73# their userspace TRACE macros. 74domain_auto_trans(traced_probes, atrace_exec, atrace); 75 76# Allow traced_probes to kill atrace on timeout. 77allow traced_probes atrace:process sigkill; 78 79# Allow traced_probes to access /proc files for system stats. 80# Note: trace data is NOT exposed to anything other than shell and privileged 81# system apps that have access to the traced consumer socket. 82allow traced_probes { 83 proc_meminfo 84 proc_vmstat 85 proc_stat 86 proc_buddyinfo 87}:file r_file_perms; 88 89# Allow access to read /sys/class/devfreq/ and /$DEVICE/cur_freq files 90allow traced_probes sysfs_devfreq_dir:dir r_dir_perms; 91allow traced_probes sysfs_devfreq_cur:file r_file_perms; 92 93# Allow access to read /proc/diskstats for I/O profiling. 94allow traced_probes proc_diskstats:file r_file_perms; 95 96# Allow access to the IHealth and IPowerStats HAL service for tracing battery counters. 97hal_client_domain(traced_probes, hal_health) 98hal_client_domain(traced_probes, hal_power_stats) 99 100# Allow access to Atrace HAL for enabling vendor/device specific tracing categories. 101hal_client_domain(traced_probes, hal_atrace) 102 103# On debug builds allow to ingest system logs into the trace. 104userdebug_or_eng(`read_logd(traced_probes)') 105 106# Allow traced_probes to talk to statsd for logging metrics and recording atoms. 107unix_socket_send(traced_probes, statsdw, statsd) 108binder_call(traced_probes, statsd) 109allow traced_probes stats_service:service_manager find; 110 111### 112### Neverallow rules 113### 114### traced_probes should NEVER do any of this 115 116# Disallow mapping executable memory (execstack and exec are already disallowed 117# globally in domain.te). 118neverallow traced_probes self:process execmem; 119 120# Block device access. 121neverallow traced_probes dev_type:blk_file { read write }; 122 123# ptrace any other app 124neverallow traced_probes domain:process ptrace; 125 126# Disallows access to /data files. 127neverallow traced_probes { 128 data_file_type 129 -apex_module_data_file 130 -apex_art_data_file 131 -apk_data_file 132 -dalvikcache_data_file 133 -system_data_file 134 -system_data_root_file 135 -media_userdir_file 136 -system_userdir_file 137 -vendor_userdir_file 138 -system_app_data_file 139 -backup_data_file 140 -bootstat_data_file 141 -update_engine_data_file 142 -update_engine_log_data_file 143 -user_profile_root_file 144 -user_profile_data_file 145 # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a 146 # subsequent neverallow. Currently only getattr and search are allowed. 147 -vendor_data_file 148 with_native_coverage(`-method_trace_data_file') 149}:dir *; 150neverallow traced_probes system_data_file:dir ~{ getattr userdebug_or_eng(`open read') search }; 151neverallow traced_probes { 152 data_file_type 153 -packages_list_file 154 with_native_coverage(`-method_trace_data_file') 155 -game_mode_intervention_list_file 156}:file *; 157 158# Only init is allowed to enter the traced_probes domain via exec() 159neverallow { domain -init } traced_probes:process transition; 160neverallow * traced_probes:process dyntransition; 161 162