android_system_sepolicy/debuggerd.te at cm-14.1 · lin14-mGoms/android_system_sepolicy · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
# debugger interface
type debuggerd, domain, domain_deprecated;
type debuggerd_exec, exec_type, file_type;

init_daemon_domain(debuggerd)
typeattribute debuggerd mlstrustedsubject;
allow debuggerd self:capability { dac_override sys_ptrace chown kill fowner setuid setgid };
allow debuggerd self:capability2 { syslog };
allow debuggerd domain:dir r_dir_perms;
allow debuggerd domain:file r_file_perms;
allow debuggerd domain:lnk_file read;
allow debuggerd {
  domain
  -adbd
  -debuggerd
  -healthd
  -init
  -keystore
  -ueventd
  -watchdogd
}:process { ptrace getattr };
security_access_policy(debuggerd)
allow debuggerd tombstone_data_file:dir rw_dir_perms;
allow debuggerd tombstone_data_file:file create_file_perms;
allow debuggerd shared_relro_file:dir r_dir_perms;
allow debuggerd shared_relro_file:file r_file_perms;
allow debuggerd domain:process { sigstop sigkill signal };
allow debuggerd exec_type:file r_file_perms;
# Access app library
allow debuggerd system_data_file:file open;
# Allow debuggerd to redirect a dump_backtrace request to itself.
# This only happens on 64 bit systems, where all requests go to the 64 bit
# debuggerd and get redirected to the 32 bit debuggerd if the process is 32 bit.

allow debuggerd {
  audioserver
  bluetooth
  cameraserver
  drmserver
  inputflinger
  mediacodec
  mediadrmserver
  mediaextractor
  mediaserver
  sdcardd
  surfaceflinger
}:debuggerd dump_backtrace;

# Connect to system_server via /data/system/ndebugsocket.
unix_socket_connect(debuggerd, system_ndebug, system_server)

userdebug_or_eng(`
  allow debuggerd input_device:dir r_dir_perms;
  allow debuggerd input_device:chr_file rw_file_perms;
')

# logd access
read_logd(debuggerd)

# Check SELinux permissions.
selinux_check_access(debuggerd)