diff --git a/public/dumpstate.te b/public/dumpstate.te index 2ba0e587394ef53efebeceef4a0ae3d6cb58195d..ac81ccc306bedce5dd274a296f6a1ad8a9688c94 100644 --- a/public/dumpstate.te +++ b/public/dumpstate.te @@ -195,6 +195,10 @@ add_service(dumpstate, dumpstate_service) ### neverallow rules ### +# dumpstate has capability sys_ptrace, but should only use that capability for +# accessing sensitive /proc/PID files, never for using ptrace attach. +neverallow dumpstate *:process ptrace; + # only system_server, dumpstate and shell can find the dumpstate service neverallow { domain -system_server -shell -dumpstate } dumpstate_service:service_manager find;