1# Perfetto tracing probes, has tracefs access.
2type traced_probes_exec, exec_type, file_type;
3
4# Allow init to exec the daemon.
5init_daemon_domain(traced_probes)
6
7# Write trace data to the Perfetto traced damon. This requires connecting to its
8# producer socket and obtaining a (per-process) tmpfs fd.
9allow traced_probes traced:fd use;
10allow traced_probes traced_tmpfs:file { read write getattr map };
11unix_socket_connect(traced_probes, traced_producer, traced)
12
13# Allow traced_probes to access tracefs.
14allow traced_probes debugfs_tracing:dir r_dir_perms;
15allow traced_probes debugfs_tracing:file rw_file_perms;
16allow traced_probes debugfs_trace_marker:file getattr;
17
18# TODO(primiano): temporarily I/O tracing categories are still
19# userdebug only until we nail down the denylist/allowlist.
20userdebug_or_eng(`
21allow traced_probes debugfs_tracing_debug:file rw_file_perms;
22')
23
24# Allow traced_probes to start with a higher scheduling class and then downgrade
25# itself.
26allow traced_probes self:global_capability_class_set { sys_nice };
27
28# Allow procfs access
29r_dir_file(traced_probes, domain)
30
31# Allow to log to kernel dmesg when starting / stopping ftrace.
32allow traced_probes kmsg_device:chr_file write;
33
34# Allow traced_probes to list the system partition.
35allow traced_probes system_file:dir { open read };
36
37# Allow traced_probes to list some of the data partition.
38allow traced_probes self:capability dac_read_search;
39
40allow traced_probes apk_data_file:dir { getattr open read search };
41allow traced_probes dalvikcache_data_file:dir { getattr open read search };
42userdebug_or_eng(`
43allow traced_probes system_data_file:dir { getattr open read search };
44')
45allow traced_probes system_app_data_file:dir { getattr open read search };
46allow traced_probes backup_data_file:dir { getattr open read search };
47allow traced_probes bootstat_data_file:dir { getattr open read search };
48allow traced_probes update_engine_data_file:dir { getattr open read search };
49allow traced_probes update_engine_log_data_file:dir { getattr open read search };
50allow traced_probes user_profile_data_file:dir { getattr open read search };
51
52# Allow traced_probes to run atrace. atrace pokes at system services to enable
53# their userspace TRACE macros.
54domain_auto_trans(traced_probes, atrace_exec, atrace);
55
56# This is needed for: path="/system/bin/linker64"
57# scontext=u:r:atrace:s0 tcontext=u:r:traced_probes:s0 tclass=fd
58allow atrace traced_probes:fd use;
59
60###
61### Neverallow rules
62###
63### traced_probes should NEVER do any of this
64
65# Disallow mapping executable memory (execstack and exec are already disallowed
66# globally in domain.te).
67neverallow traced_probes self:process execmem;
68
69# Block device access.
70neverallow traced_probes dev_type:blk_file { read write };
71
72# ptrace any other app
73neverallow traced_probes domain:process ptrace;
74
75# Disallows access to /data files.
76neverallow traced_probes {
77  data_file_type
78  -apk_data_file
79  -dalvikcache_data_file
80  -system_data_file
81  -system_app_data_file
82  -backup_data_file
83  -bootstat_data_file
84  -update_engine_data_file
85  -update_engine_log_data_file
86  -user_profile_data_file
87  # TODO(b/72998741) Remove vendor_data_file exemption. Further restricted in a
88  # subsequent neverallow. Currently only getattr and search are allowed.
89  -vendor_data_file
90  -zoneinfo_data_file
91}:dir *;
92neverallow traced_probes system_data_file:dir ~{ getattr userdebug_or_eng(`open read') search };
93neverallow traced_probes zoneinfo_data_file:dir ~r_dir_perms;
94neverallow traced_probes { data_file_type -zoneinfo_data_file }:lnk_file *;
95neverallow traced_probes { data_file_type -zoneinfo_data_file }:file *;
96
97# Only init is allowed to enter the traced_probes domain via exec()
98neverallow { domain -init } traced_probes:process transition;
99neverallow * traced_probes:process dyntransition;
100