| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778 |
- # Domain for atrace process.
- # It is spawned either by traced_probes or by init for the boottrace service.
- type atrace, domain, coredomain;
- type atrace_exec, exec_type, file_type, system_file_type;
- # boottrace services uses /data/misc/boottrace/categories
- allow atrace boottrace_data_file:dir search;
- allow atrace boottrace_data_file:file r_file_perms;
- # Allow atrace to access tracefs.
- allow atrace debugfs_tracing:dir r_dir_perms;
- allow atrace debugfs_tracing:file rw_file_perms;
- allow atrace debugfs_trace_marker:file getattr;
- # Allow atrace to write data when a pipe is used for stdout/stderr
- # This is used by Perfetto to capture the output on error in atrace.
- allow atrace traced_probes:fd use;
- allow atrace traced_probes:fifo_file write;
- # atrace sets debug.atrace.* properties
- set_prop(atrace, debug_prop)
- # atrace pokes all the binder-enabled processes at startup with a
- # SYSPROPS_TRANSACTION, to tell them to reload the debug.atrace.* properties.
- # Allow discovery of binder services.
- allow atrace {
- service_manager_type
- -apex_service
- -incident_service
- -iorapd_service
- -netd_service
- -dnsresolver_service
- -stats_service
- -dumpstate_service
- -installd_service
- -vold_service
- -lpdump_service
- }:service_manager { find };
- allow atrace servicemanager:service_manager list;
- # Allow notifying the processes hosting specific binder services that
- # trace-related system properties have changed.
- binder_use(atrace)
- allow atrace healthd:binder call;
- allow atrace surfaceflinger:binder call;
- allow atrace system_server:binder call;
- allow atrace cameraserver:binder call;
- # Similarly, on debug builds, allow specific HALs to be notified that
- # trace-related system properties have changed.
- userdebug_or_eng(`
- # List HAL interfaces.
- allow atrace hwservicemanager:hwservice_manager list;
- # Notify the camera HAL.
- hal_client_domain(atrace, hal_camera)
- ')
- # Remove logspam from notification attempts to non-whitelisted services.
- dontaudit atrace hwservice_manager_type:hwservice_manager find;
- dontaudit atrace service_manager_type:service_manager find;
- dontaudit atrace domain:binder call;
- # atrace can call atrace HAL
- hal_client_domain(atrace, hal_atrace)
- get_prop(atrace, hwservicemanager_prop)
- userdebug_or_eng(`
- # atrace is generally invoked as a standalone binary from shell or perf
- # daemons like Perfetto traced_probes. However, in userdebug builds, there is
- # a further option to run atrace as an init daemon for boot tracing.
- init_daemon_domain(atrace)
- allow atrace debugfs_tracing_debug:dir r_dir_perms;
- allow atrace debugfs_tracing_debug:file rw_file_perms;
- ')
|
