1*e4a36f41SAndroid Build Coastguard Workertypeattribute logpersist coredomain; 2*e4a36f41SAndroid Build Coastguard Worker 3*e4a36f41SAndroid Build Coastguard Worker# android debug log storage in logpersist domains (eng and userdebug only) 4*e4a36f41SAndroid Build Coastguard Workeruserdebug_or_eng(` 5*e4a36f41SAndroid Build Coastguard Worker 6*e4a36f41SAndroid Build Coastguard Worker r_dir_file(logpersist, cgroup) 7*e4a36f41SAndroid Build Coastguard Worker r_dir_file(logpersist, cgroup_v2) 8*e4a36f41SAndroid Build Coastguard Worker 9*e4a36f41SAndroid Build Coastguard Worker allow logpersist misc_logd_file:file create_file_perms; 10*e4a36f41SAndroid Build Coastguard Worker allow logpersist misc_logd_file:dir rw_dir_perms; 11*e4a36f41SAndroid Build Coastguard Worker 12*e4a36f41SAndroid Build Coastguard Worker allow logpersist self:global_capability_class_set sys_nice; 13*e4a36f41SAndroid Build Coastguard Worker allow logpersist pstorefs:dir search; 14*e4a36f41SAndroid Build Coastguard Worker allow logpersist pstorefs:file r_file_perms; 15*e4a36f41SAndroid Build Coastguard Worker 16*e4a36f41SAndroid Build Coastguard Worker control_logd(logpersist) 17*e4a36f41SAndroid Build Coastguard Worker unix_socket_connect(logpersist, logdr, logd) 18*e4a36f41SAndroid Build Coastguard Worker get_prop(logpersist, logd_prop) 19*e4a36f41SAndroid Build Coastguard Worker read_runtime_log_tags(logpersist) 20*e4a36f41SAndroid Build Coastguard Worker 21*e4a36f41SAndroid Build Coastguard Worker') 22*e4a36f41SAndroid Build Coastguard Worker 23*e4a36f41SAndroid Build Coastguard Worker# logcatd is a shell script that execs logcat with various parameters. 24*e4a36f41SAndroid Build Coastguard Workerallow logpersist shell_exec:file rx_file_perms; 25*e4a36f41SAndroid Build Coastguard Workerallow logpersist logcat_exec:file rx_file_perms; 26*e4a36f41SAndroid Build Coastguard Worker 27*e4a36f41SAndroid Build Coastguard Workerallowxperm logpersist misc_logd_file:file ioctl { 28*e4a36f41SAndroid Build Coastguard Worker F2FS_IOC_RELEASE_COMPRESS_BLOCKS 29*e4a36f41SAndroid Build Coastguard Worker FS_IOC_SETFLAGS 30*e4a36f41SAndroid Build Coastguard Worker}; 31*e4a36f41SAndroid Build Coastguard Worker 32*e4a36f41SAndroid Build Coastguard Worker### 33*e4a36f41SAndroid Build Coastguard Worker### Neverallow rules 34*e4a36f41SAndroid Build Coastguard Worker### 35*e4a36f41SAndroid Build Coastguard Worker### logpersist should NEVER do any of this 36*e4a36f41SAndroid Build Coastguard Worker 37*e4a36f41SAndroid Build Coastguard Worker# Block device access. 38*e4a36f41SAndroid Build Coastguard Workerneverallow logpersist dev_type:blk_file { read write }; 39*e4a36f41SAndroid Build Coastguard Worker 40*e4a36f41SAndroid Build Coastguard Worker# ptrace any other app 41*e4a36f41SAndroid Build Coastguard Workerneverallow logpersist domain:process ptrace; 42*e4a36f41SAndroid Build Coastguard Worker 43*e4a36f41SAndroid Build Coastguard Worker# Write to files in /data/data or system files on /data except misc_logd_file 44*e4a36f41SAndroid Build Coastguard Workerneverallow logpersist { app_data_file_type system_data_file }:dir_file_class_set write; 45*e4a36f41SAndroid Build Coastguard Worker 46*e4a36f41SAndroid Build Coastguard Worker# Only init should be allowed to enter the logpersist domain via exec() 47*e4a36f41SAndroid Build Coastguard Worker# Following is a list of debug domains we know that transition to logpersist 48*e4a36f41SAndroid Build Coastguard Worker# neverallow_with_undefined_domains { 49*e4a36f41SAndroid Build Coastguard Worker# domain 50*e4a36f41SAndroid Build Coastguard Worker# -init # goldfish, logcatd, raft 51*e4a36f41SAndroid Build Coastguard Worker# -mmi # bat, mtp8996, msmcobalt 52*e4a36f41SAndroid Build Coastguard Worker# -system_app # Smith.apk 53*e4a36f41SAndroid Build Coastguard Worker# } logpersist:process transition; 54*e4a36f41SAndroid Build Coastguard Workerneverallow * logpersist:process dyntransition; 55*e4a36f41SAndroid Build Coastguard Worker 56*e4a36f41SAndroid Build Coastguard Worker# logpersist is allowed to write to /data/misc/log for userdebug and eng builds 57*e4a36f41SAndroid Build Coastguard Workerneverallow logpersist { 58*e4a36f41SAndroid Build Coastguard Worker file_type 59*e4a36f41SAndroid Build Coastguard Worker userdebug_or_eng(`-misc_logd_file -coredump_file') 60*e4a36f41SAndroid Build Coastguard Worker with_native_coverage(`-method_trace_data_file') 61*e4a36f41SAndroid Build Coastguard Worker}:file { create write append }; 62*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -init -dumpstate -incidentd userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_rw_file_perms; 63*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:file no_w_file_perms; 64*e4a36f41SAndroid Build Coastguard Workerneverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write }; 65