Remove perfprofd references.
perfprofd was never finished, and has been removed.
Test: treehugger
Change-Id: I4fc8aa9b737360a66d89c5be39651284ee2d6ffd
diff --git a/private/compat/26.0/26.0.cil b/private/compat/26.0/26.0.cil
index 3b3dae1..2d1a612 100644
--- a/private/compat/26.0/26.0.cil
+++ b/private/compat/26.0/26.0.cil
@@ -432,9 +432,6 @@
(typeattributeset pdx_performance_dir_26_0 (pdx_performance_dir))
(typeattributeset performanced_26_0 (performanced))
(typeattributeset performanced_exec_26_0 (performanced_exec))
-(typeattributeset perfprofd_26_0 (perfprofd))
-(typeattributeset perfprofd_data_file_26_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_26_0 (perfprofd_exec))
(typeattributeset permission_service_26_0 (permission_service))
(typeattributeset persist_debug_prop_26_0 (persist_debug_prop))
(typeattributeset persistent_data_block_service_26_0 (persistent_data_block_service))
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index c005a14..9ab631a 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -132,7 +132,6 @@
perfetto_exec
perfetto_tmpfs
perfetto_traces_data_file
- perfprofd_service
property_info
recovery_socket
role_service
diff --git a/private/compat/27.0/27.0.cil b/private/compat/27.0/27.0.cil
index e539d3b..ab56f4e 100644
--- a/private/compat/27.0/27.0.cil
+++ b/private/compat/27.0/27.0.cil
@@ -430,9 +430,6 @@
(expandtypeattribute (pdx_performance_dir_27_0) true)
(expandtypeattribute (performanced_27_0) true)
(expandtypeattribute (performanced_exec_27_0) true)
-(expandtypeattribute (perfprofd_27_0) true)
-(expandtypeattribute (perfprofd_data_file_27_0) true)
-(expandtypeattribute (perfprofd_exec_27_0) true)
(expandtypeattribute (permission_service_27_0) true)
(expandtypeattribute (persist_debug_prop_27_0) true)
(expandtypeattribute (persistent_data_block_service_27_0) true)
@@ -1147,9 +1144,6 @@
(typeattributeset pdx_performance_dir_27_0 (pdx_performance_dir))
(typeattributeset performanced_27_0 (performanced))
(typeattributeset performanced_exec_27_0 (performanced_exec))
-(typeattributeset perfprofd_27_0 (perfprofd))
-(typeattributeset perfprofd_data_file_27_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_27_0 (perfprofd_exec))
(typeattributeset permission_service_27_0 (permission_service))
(typeattributeset persist_debug_prop_27_0 (persist_debug_prop))
(typeattributeset persistent_data_block_service_27_0 (persistent_data_block_service))
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index 7d2f8dd..a3f30d4 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -119,7 +119,6 @@
perfetto_exec
perfetto_tmpfs
perfetto_traces_data_file
- perfprofd_service
property_info
recovery_socket
role_service
diff --git a/private/compat/28.0/28.0.cil b/private/compat/28.0/28.0.cil
index fbe8588..1a2bd43 100644
--- a/private/compat/28.0/28.0.cil
+++ b/private/compat/28.0/28.0.cil
@@ -501,10 +501,6 @@
(expandtypeattribute (pdx_performance_dir_28_0) true)
(expandtypeattribute (performanced_28_0) true)
(expandtypeattribute (performanced_exec_28_0) true)
-(expandtypeattribute (perfprofd_28_0) true)
-(expandtypeattribute (perfprofd_data_file_28_0) true)
-(expandtypeattribute (perfprofd_exec_28_0) true)
-(expandtypeattribute (perfprofd_service_28_0) true)
(expandtypeattribute (permission_service_28_0) true)
(expandtypeattribute (persist_debug_prop_28_0) true)
(expandtypeattribute (persistent_data_block_service_28_0) true)
@@ -1346,10 +1342,6 @@
(typeattributeset pdx_performance_dir_28_0 (pdx_performance_dir))
(typeattributeset performanced_28_0 (performanced))
(typeattributeset performanced_exec_28_0 (performanced_exec))
-(typeattributeset perfprofd_28_0 (perfprofd))
-(typeattributeset perfprofd_data_file_28_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_28_0 (perfprofd_exec))
-(typeattributeset perfprofd_service_28_0 (perfprofd_service))
(typeattributeset permission_service_28_0 (permission_service))
(typeattributeset persist_debug_prop_28_0 (persist_debug_prop))
(typeattributeset persistent_data_block_service_28_0 (persistent_data_block_service))
diff --git a/private/compat/29.0/29.0.cil b/private/compat/29.0/29.0.cil
index dd52e0e..01e8605 100644
--- a/private/compat/29.0/29.0.cil
+++ b/private/compat/29.0/29.0.cil
@@ -1,5 +1,7 @@
;; types removed from current policy
(type hal_wifi_offload_hwservice)
+(type perfprofd_data_file)
+(type perfprofd_service)
(expandtypeattribute (accessibility_service_29_0) true)
(expandtypeattribute (account_service_29_0) true)
@@ -553,10 +555,6 @@
(expandtypeattribute (perfetto_29_0) true)
(expandtypeattribute (performanced_29_0) true)
(expandtypeattribute (performanced_exec_29_0) true)
-(expandtypeattribute (perfprofd_29_0) true)
-(expandtypeattribute (perfprofd_data_file_29_0) true)
-(expandtypeattribute (perfprofd_exec_29_0) true)
-(expandtypeattribute (perfprofd_service_29_0) true)
(expandtypeattribute (permissionmgr_service_29_0) true)
(expandtypeattribute (permission_service_29_0) true)
(expandtypeattribute (persist_debug_prop_29_0) true)
@@ -1531,10 +1529,6 @@
(typeattributeset perfetto_29_0 (perfetto))
(typeattributeset performanced_29_0 (performanced))
(typeattributeset performanced_exec_29_0 (performanced_exec))
-(typeattributeset perfprofd_29_0 (perfprofd))
-(typeattributeset perfprofd_data_file_29_0 (perfprofd_data_file))
-(typeattributeset perfprofd_exec_29_0 (perfprofd_exec))
-(typeattributeset perfprofd_service_29_0 (perfprofd_service))
(typeattributeset permissionmgr_service_29_0 (permissionmgr_service))
(typeattributeset permission_service_29_0 (permission_service))
(typeattributeset persist_debug_prop_29_0 (persist_debug_prop))
diff --git a/private/coredomain.te b/private/coredomain.te
index 169f6b2..7ad5856 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -25,7 +25,6 @@
-idmap
-init
-installd
- userdebug_or_eng(`-perfprofd')
userdebug_or_eng(`-heapprofd')
-postinstall_dexopt
-rs # spawned by appdomain, so carryover the exception above
@@ -41,7 +40,6 @@
-idmap
-init
-installd
- userdebug_or_eng(`-perfprofd')
userdebug_or_eng(`-heapprofd')
-postinstall_dexopt
-rs # spawned by appdomain, so carryover the exception above
@@ -126,7 +124,6 @@
-atrace
-dumpstate
-init
- userdebug_or_eng(`-perfprofd')
-traced_probes
-shell
-traceur_app
@@ -196,12 +193,10 @@
coredomain
-init
-iorapd
- -perfprofd
} ashmem_device_service:service_manager find;
binder_call({
coredomain
-init
-iorapd
- -perfprofd
}, ashmemd)
diff --git a/private/domain.te b/private/domain.te
index 670e353..8f7a1e0 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -95,7 +95,6 @@
userdebug_or_eng(`-incidentd')
-storaged
-system_server
- userdebug_or_eng(`-perfprofd')
} self:global_capability_class_set sys_ptrace;
# Limit ability to generate hardware unique device ID attestations to priv_apps
@@ -130,7 +129,6 @@
-app_zygote
-dexoptanalyzer
-installd
- userdebug_or_eng(`-perfprofd')
-profman
-rs # spawned by appdomain, so carryover the exception above
-runas
@@ -152,7 +150,6 @@
-appdomain
-app_zygote
-installd
- userdebug_or_eng(`-perfprofd')
-rs # spawned by appdomain, so carryover the exception above
} { privapp_data_file app_data_file }:file_class_set open;
@@ -261,7 +258,6 @@
userdebug_or_eng(`llkd')
lmkd
netd
- perfprofd
postinstall_dexopt
recovery
rss_hwm_reset
diff --git a/private/dumpstate.te b/private/dumpstate.te
index 4f6d96a..1b0832e 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -44,7 +44,6 @@
allow dumpstate debugfs_wakeup_sources:file r_file_perms;
allow dumpstate dev_type:blk_file getattr;
allow dumpstate webview_zygote:process signal;
-dontaudit dumpstate perfprofd:binder call;
dontaudit dumpstate update_engine:binder call;
allow dumpstate proc_net_tcp_udp:file r_file_perms;
diff --git a/private/file_contexts b/private/file_contexts
index 6975e7c..9f9ada5 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -257,7 +257,6 @@
/system/bin/pppd u:object_r:ppp_exec:s0
/system/bin/racoon u:object_r:racoon_exec:s0
/system/xbin/su u:object_r:su_exec:s0
-/system/bin/perfprofd u:object_r:perfprofd_exec:s0
/system/bin/dnsmasq u:object_r:dnsmasq_exec:s0
/system/bin/healthd u:object_r:healthd_exec:s0
/system/bin/clatd u:object_r:clatd_exec:s0
@@ -512,7 +511,6 @@
/data/misc/zoneinfo(/.*)? u:object_r:zoneinfo_data_file:s0
/data/misc/vold(/.*)? u:object_r:vold_data_file:s0
/data/misc/iorapd(/.*)? u:object_r:iorapd_data_file:s0
-/data/misc/perfprofd(/.*)? u:object_r:perfprofd_data_file:s0
/data/misc/update_engine(/.*)? u:object_r:update_engine_data_file:s0
/data/misc/update_engine_log(/.*)? u:object_r:update_engine_log_data_file:s0
/data/system/dropbox(/.*)? u:object_r:dropbox_data_file:s0
diff --git a/private/perfprofd.te b/private/perfprofd.te
deleted file mode 100644
index 94a7c1d..0000000
--- a/private/perfprofd.te
+++ /dev/null
@@ -1,29 +0,0 @@
-typeattribute perfprofd coredomain;
-
-userdebug_or_eng(`
- init_daemon_domain(perfprofd)
-')
-
-neverallow {
- domain
- userdebug_or_eng(`
- -statsd
- -system_server
- -system_suspend_server
- -hal_health_server
- -hwservicemanager
- ')
-} perfprofd:binder call;
-
-neverallow perfprofd {
- domain
- userdebug_or_eng(`
- -servicemanager
- -statsd
- -su
- -system_server
- -system_suspend_server
- -hal_health_server
- -hwservicemanager
- ')
-}:binder call;
diff --git a/private/priv_app.te b/private/priv_app.te
index 35ad8c2..5768f00 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -83,14 +83,6 @@
# b/18504118: Allow reads from /data/anr/traces.txt
allow priv_app anr_data_file:file r_file_perms;
-# Allow GMS core to access perfprofd output, which is stored
-# in /data/misc/perfprofd/. GMS core will need to list all
-# data stored in that directory to process them one by one.
-userdebug_or_eng(`
- allow priv_app perfprofd_data_file:file r_file_perms;
- allow priv_app perfprofd_data_file:dir r_dir_perms;
-')
-
# For AppFuse.
allow priv_app vold:fd use;
allow priv_app fuse_device:chr_file { read write };
diff --git a/private/service_contexts b/private/service_contexts
index 7d6cb47..87fed88 100644
--- a/private/service_contexts
+++ b/private/service_contexts
@@ -139,7 +139,6 @@
overlay u:object_r:overlay_service:s0
package u:object_r:package_service:s0
package_native u:object_r:package_native_service:s0
-perfprofd u:object_r:perfprofd_service:s0
permission u:object_r:permission_service:s0
permissionmgr u:object_r:permissionmgr_service:s0
persistent_data_block u:object_r:persistent_data_block_service:s0
diff --git a/private/system_server.te b/private/system_server.te
index df87794..1f8945b 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -202,9 +202,6 @@
binder_call(system_server, vold)
binder_call(system_server, wificond)
binder_call(system_server, wpantund)
-userdebug_or_eng(`
- binder_call(system_server, perfprofd)
-')
binder_service(system_server)
# Use HALs
@@ -432,12 +429,6 @@
allow system_server perfetto_traces_data_file:file read;
allow system_server perfetto:fd use;
-# Allow dropbox to read /data/misc/perfprofd. Only the fd is sent over binder.
-userdebug_or_eng(`
- allow system_server perfprofd_data_file:file { getattr read };
- allow system_server perfprofd:fd use;
-')
-
# Manage /data/backup.
allow system_server backup_data_file:dir create_dir_perms;
allow system_server backup_data_file:file create_file_perms;
@@ -736,9 +727,6 @@
allow system_server update_engine_service:service_manager find;
allow system_server vold_service:service_manager find;
allow system_server wificond_service:service_manager find;
-userdebug_or_eng(`
- allow system_server perfprofd_service:service_manager find;
-')
add_service(system_server, batteryproperties_service)
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index 3c20c08..de047da 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -104,14 +104,6 @@
# Allow untrusted apps to interact with gpuservice
binder_call(untrusted_app_all, gpuservice)
-# Allow GMS core to access perfprofd output, which is stored
-# in /data/misc/perfprofd/. GMS core will need to list all
-# data stored in that directory to process them one by one.
-userdebug_or_eng(`
- allow untrusted_app_all perfprofd_data_file:file r_file_perms;
- allow untrusted_app_all perfprofd_data_file:dir r_dir_perms;
-')
-
# gdbserver for ndk-gdb ptrace attaches to app process.
allow untrusted_app_all self:process ptrace;
diff --git a/public/domain.te b/public/domain.te
index b620ec1..cd08746 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -998,7 +998,6 @@
-crash_dump
-init # starts vendor executables
-kernel # loads /vendor/firmware
- userdebug_or_eng(`-perfprofd')
userdebug_or_eng(`-heapprofd')
-shell
-system_executes_vendor_violators
@@ -1323,7 +1322,6 @@
-crash_dump
-init
-kernel
- -perfprofd
-heapprofd
-ueventd
} vendor_file:file { no_w_file_perms no_x_file_perms open };
diff --git a/public/file.te b/public/file.te
index c78ddd5..4945686 100644
--- a/public/file.te
+++ b/public/file.te
@@ -351,7 +351,6 @@
type zoneinfo_data_file, file_type, data_file_type, core_data_file_type;
type vold_data_file, file_type, data_file_type, core_data_file_type;
type iorapd_data_file, file_type, data_file_type, core_data_file_type;
-type perfprofd_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
type tee_data_file, file_type, data_file_type;
type update_engine_data_file, file_type, data_file_type, core_data_file_type;
type update_engine_log_data_file, file_type, data_file_type, core_data_file_type;
diff --git a/public/perfprofd.te b/public/perfprofd.te
deleted file mode 100644
index 47dfbf2..0000000
--- a/public/perfprofd.te
+++ /dev/null
@@ -1,121 +0,0 @@
-# perfprofd - perf profile collection daemon
-type perfprofd, domain;
-type perfprofd_exec, system_file_type, exec_type, file_type;
-
-userdebug_or_eng(`
-
- typeattribute perfprofd coredomain;
- typeattribute perfprofd mlstrustedsubject;
-
- # perfprofd access to sysfs directory structure.
- allow perfprofd sysfs_type:dir search;
-
- # perfprofd needs to control CPU hot-plug in order to avoid kernel
- # perfevents problems in cases where CPU goes on/off during measurement;
- # this means read access to /sys/devices/system/cpu/possible
- # and read/write access to /sys/devices/system/cpu/cpu*/online
- allow perfprofd sysfs_devices_system_cpu:file rw_file_perms;
-
- # perfprofd checks for the existence of and then invokes simpleperf;
- # simpleperf retains perfprofd domain after exec
- allow perfprofd system_file:file rx_file_perms;
-
- # perfprofd reads a config file from /data/data/com.google.android.gms/files
- allow perfprofd { privapp_data_file app_data_file }:file r_file_perms;
- allow perfprofd { privapp_data_file app_data_file }:dir search;
- allow perfprofd self:global_capability_class_set { dac_override dac_read_search };
-
- # perfprofd opens a file for writing in /data/misc/perfprofd
- allow perfprofd perfprofd_data_file:file create_file_perms;
- allow perfprofd perfprofd_data_file:dir rw_dir_perms;
-
- # perfprofd uses the system log
- read_logd(perfprofd);
- write_logd(perfprofd);
-
- # perfprofd inspects /sys/power/wake_unlock
- wakelock_use(perfprofd);
-
- # perfprofd looks at thermals.
- allow perfprofd sysfs_thermal:dir r_dir_perms;
-
- # perfprofd gets charging status.
- hal_client_domain(perfprofd, hal_health)
-
- # simpleperf reads kernel notes.
- allow perfprofd sysfs_kernel_notes:file r_file_perms;
-
- # Simpleperf & perfprofd query a range of proc stats.
- allow perfprofd proc_loadavg:file r_file_perms;
- allow perfprofd proc_stat:file r_file_perms;
- allow perfprofd proc_modules:file r_file_perms;
-
- # simpleperf writes to perf_event_paranoid under /proc.
- allow perfprofd proc_perf:file write;
-
- # Simpleperf: kptr_restrict. This would be required to dump kernel symbols.
- dontaudit perfprofd proc_security:file *;
-
- # simpleperf uses ioctl() to turn on kernel perf events measurements
- allow perfprofd self:global_capability_class_set sys_admin;
-
- # simpleperf needs to examine /proc to collect task/thread info
- r_dir_file(perfprofd, domain)
-
- # simpleperf needs to access /proc/<pid>/exec
- allow perfprofd self:global_capability_class_set { sys_resource sys_ptrace };
- neverallow perfprofd domain:process ptrace;
-
- # simpleperf needs open/read any file that turns up in a profile
- # to see whether it has a build ID
- allow perfprofd exec_type:file r_file_perms;
- # App & ART artifacts.
- r_dir_file(perfprofd, apk_data_file)
- r_dir_file(perfprofd, dalvikcache_data_file)
- # Vendor libraries.
- r_dir_file(perfprofd, vendor_file)
- # Vendor apps.
- r_dir_file(perfprofd, vendor_app_file)
- # SP HAL files.
- r_dir_file(perfprofd, same_process_hal_file)
-
- # simpleperf will set security.perf_harden to enable access to perf_event_open()
- set_prop(perfprofd, shell_prop)
-
- # simpleperf examines debugfs on startup to collect tracepoint event types
- r_dir_file(perfprofd, debugfs_tracing)
- r_dir_file(perfprofd, debugfs_tracing_debug)
-
- # simpleperf is going to execute "sleep"
- allow perfprofd toolbox_exec:file rx_file_perms;
- # simpleperf is going to execute "mv" on a temp file
- allow perfprofd shell_exec:file rx_file_perms;
-
- # needed for simpleperf on some kernels
- allow perfprofd self:global_capability_class_set ipc_lock;
-
- # simpleperf attempts to put a temp file into /data/local/tmp. Do not allow,
- # use the fallback cwd code, do not spam the log. But ensure this is correctly
- # removed at some point. b/70232908.
- dontaudit perfprofd shell_data_file:dir *;
- dontaudit perfprofd shell_data_file:file *;
-
- # Allow perfprofd to publish a binder service and make binder calls.
- binder_use(perfprofd)
- add_service(perfprofd, perfprofd_service)
-
- # Use devpts for streams from cmd.
- #
- # This is normally granted to binderservicedomain, but this service
- # has tighter restrictions on the callers (see below), so must enable
- # this manually.
- allow perfprofd devpts:chr_file rw_file_perms;
-
- # Use socket & pipe supplied by su, for cmd perfprofd dump.
- allow perfprofd su:unix_stream_socket { read write getattr sendto };
- allow perfprofd su:fifo_file r_file_perms;
-
- # Allow perfprofd to submit to dropbox.
- allow perfprofd dropbox_service:service_manager find;
- binder_call(perfprofd, system_server)
-')
diff --git a/public/service.te b/public/service.te
index 649dfa7..645f71c 100644
--- a/public/service.te
+++ b/public/service.te
@@ -25,7 +25,6 @@
type mediadrmserver_service, service_manager_type;
type netd_service, service_manager_type;
type nfc_service, service_manager_type;
-type perfprofd_service, service_manager_type;
type radio_service, service_manager_type;
type secure_element_service, service_manager_type;
type storaged_service, service_manager_type;
diff --git a/public/statsd.te b/public/statsd.te
index 089cae9..435bbdf 100644
--- a/public/statsd.te
+++ b/public/statsd.te
@@ -27,9 +27,6 @@
binder_call(statsd, appdomain)
binder_call(statsd, healthd)
binder_call(statsd, incidentd)
-userdebug_or_eng(`
- binder_call(statsd, perfprofd)
-')
binder_call(statsd, system_server)
# Allow statsd to interact with gpuservice
@@ -44,9 +41,6 @@
allow statsd {
app_api_service
incident_service
- userdebug_or_eng(`
- perfprofd_service
- ')
system_api_service
}:service_manager find;