| Alex Klyubin | f5446eb | 2017-03-23 14:27:32 -0700 | [diff] [blame] | 1 | typeattribute logd coredomain; |
| 2 | |
| dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 3 | init_daemon_domain(logd) |
| dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 4 | |
| Inseob Kim | 55e5c9b | 2020-03-04 17:20:35 +0900 | [diff] [blame] | 5 | # Access device logging gating property |
| 6 | get_prop(logd, device_logging_prop) |
| 7 | |
| dcashman | 2e00e63 | 2016-10-12 14:58:09 -0700 | [diff] [blame] | 8 | # logd is not allowed to write anywhere other than /data/misc/logd, and then |
| 9 | # only on userdebug or eng builds |
| Mark Salyzyn | d33a9a1 | 2016-11-07 15:11:39 -0800 | [diff] [blame] | 10 | neverallow logd { |
| 11 | file_type |
| Mark Salyzyn | d33a9a1 | 2016-11-07 15:11:39 -0800 | [diff] [blame] | 12 | -runtime_event_log_tags_file |
| Wenhao Wang | 6a656c0 | 2022-01-11 15:16:12 -0800 | [diff] [blame] | 13 | # shell_data_file access is needed to dump bugreports |
| 14 | -shell_data_file |
| Mark Salyzyn | 384ce66 | 2016-09-13 09:33:35 -0700 | [diff] [blame] | 15 | userdebug_or_eng(`-coredump_file -misc_logd_file') |
| Pirama Arumuga Nainar | ce9c0c5 | 2019-06-13 15:05:15 -0700 | [diff] [blame] | 16 | with_native_coverage(`-method_trace_data_file') |
| Mark Salyzyn | d33a9a1 | 2016-11-07 15:11:39 -0800 | [diff] [blame] | 17 | }:file { create write append }; |
| 18 | |
| 19 | # protect the event-log-tags file |
| 20 | neverallow { |
| 21 | domain |
| 22 | -appdomain # covered below |
| 23 | -bootstat |
| 24 | -dumpstate |
| Mark Salyzyn | 384ce66 | 2016-09-13 09:33:35 -0700 | [diff] [blame] | 25 | -init |
| Mark Salyzyn | d33a9a1 | 2016-11-07 15:11:39 -0800 | [diff] [blame] | 26 | -logd |
| 27 | userdebug_or_eng(`-logpersist') |
| 28 | -servicemanager |
| 29 | -system_server |
| 30 | -surfaceflinger |
| 31 | -zygote |
| 32 | } runtime_event_log_tags_file:file no_rw_file_perms; |
| 33 | |
| 34 | neverallow { |
| 35 | appdomain |
| 36 | -bluetooth |
| 37 | -platform_app |
| 38 | -priv_app |
| 39 | -radio |
| 40 | -shell |
| 41 | userdebug_or_eng(`-su') |
| 42 | -system_app |
| 43 | } runtime_event_log_tags_file:file no_rw_file_perms; |
| Wenhao Wang | 6a656c0 | 2022-01-11 15:16:12 -0800 | [diff] [blame] | 44 | |
| 45 | # Only binder communication between logd and system_server is allowed |
| 46 | binder_use(logd) |
| 47 | binder_service(logd) |
| 48 | binder_call(logd, system_server) |
| 49 | |
| 50 | add_service(logd, logd_service) |
| 51 | allow logd logcat_service:service_manager find; |