You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
40 lines
839 B
40 lines
839 B
4 months ago
|
typeattribute logd coredomain;
|
||
|
|
|
||
|
|
init_daemon_domain(logd)
|
||
|
|
|
||
|
|
# logd is not allowed to write anywhere other than /data/misc/logd, and then
|
||
|
|
# only on userdebug or eng builds
|
||
|
|
# TODO: deal with tmpfs_domain pub/priv split properly
|
||
|
|
neverallow logd {
|
||
|
|
file_type
|
||
|
|
-logd_tmpfs
|
||
|
|
-runtime_event_log_tags_file
|
||
|
|
userdebug_or_eng(`-coredump_file -misc_logd_file')
|
||
|
|
}:file { create write append };
|
||
|
|
|
||
|
|
# protect the event-log-tags file
|
||
|
|
neverallow {
|
||
|
|
domain
|
||
|
|
-appdomain # covered below
|
||
|
|
-bootstat
|
||
|
|
-dumpstate
|
||
|
|
-init
|
||
|
|
-logd
|
||
|
|
userdebug_or_eng(`-logpersist')
|
||
|
|
-servicemanager
|
||
|
|
-system_server
|
||
|
|
-surfaceflinger
|
||
|
|
-zygote
|
||
|
|
} runtime_event_log_tags_file:file no_rw_file_perms;
|
||
|
|
|
||
|
|
neverallow {
|
||
|
|
appdomain
|
||
|
|
-bluetooth
|
||
|
|
-platform_app
|
||
|
|
-priv_app
|
||
|
|
-radio
|
||
|
|
-shell
|
||
|
|
userdebug_or_eng(`-su')
|
||
|
|
-system_app
|
||
|
|
} runtime_event_log_tags_file:file no_rw_file_perms;
|