Skip to content
Snippets Groups Projects
Commit 208deb33 authored by Stephen Smalley's avatar Stephen Smalley
Browse files

Allow dumpstate to run am and shell.

See http://code.google.com/p/android/issues/detail?id=65339



Further denials were observed in testing and allowed as well.

Change-Id: I54e56bf5650b50b61e092a6dac45c971397df60f
Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
parent 997680a3
No related branches found
No related tags found
No related merge requests found
...@@ -73,3 +73,16 @@ allow dumpstate self:capability sys_ptrace; ...@@ -73,3 +73,16 @@ allow dumpstate self:capability sys_ptrace;
# /data/data/com.android.shell/files/bugreports/bugreport # /data/data/com.android.shell/files/bugreports/bugreport
allow dumpstate shell_data_file:dir create_dir_perms; allow dumpstate shell_data_file:dir create_dir_perms;
allow dumpstate shell_data_file:file create_file_perms; allow dumpstate shell_data_file:file create_file_perms;
# Run a shell.
allow dumpstate shell_exec:file rx_file_perms;
# For running am and similar framework commands.
# Run /system/bin/app_process.
allow dumpstate zygote_exec:file rx_file_perms;
# Dalvik Compiler JIT.
allow dumpstate ashmem_device:chr_file execute;
allow dumpstate dumpstate_tmpfs:file execute;
allow dumpstate self:process execmem;
# For art.
allow dumpstate dalvikcache_data_file:file execute;
...@@ -104,6 +104,7 @@ binder_use(system_server) ...@@ -104,6 +104,7 @@ binder_use(system_server)
binder_call(system_server, binderservicedomain) binder_call(system_server, binderservicedomain)
binder_call(system_server, appdomain) binder_call(system_server, appdomain)
binder_call(system_server, healthd) binder_call(system_server, healthd)
binder_call(system_server, dumpstate)
binder_service(system_server) binder_service(system_server)
# Read /proc/pid files for Binder clients. # Read /proc/pid files for Binder clients.
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment