diff --git a/private/system_server.te b/private/system_server.te index 6d3d1e3400f84f9ba857189732ad2cf9674c4c04..e916415539678659d8251e3384bd3df902f7b577 100644 --- a/private/system_server.te +++ b/private/system_server.te @@ -167,6 +167,9 @@ unix_socket_connect(system_server, zygote, zygote) unix_socket_connect(system_server, racoon, racoon) unix_socket_connect(system_server, uncrypt, uncrypt) +# Allow system_server to write to statsd. +unix_socket_send(system_server, statsdw, statsd) + # Communicate over a socket created by surfaceflinger. allow system_server surfaceflinger:unix_stream_socket { read write setopt }; diff --git a/private/zygote.te b/private/zygote.te index 3affec13764aa9293be4a3395c3c1a53b9d7f864..0b087acb71710d8cfd86e417b8ca408e213f15f1 100644 --- a/private/zygote.te +++ b/private/zygote.te @@ -96,6 +96,9 @@ allow zygote sdcardfs:dir { mounton }; # Handle --invoke-with command when launching Zygote with a wrapper command. allow zygote zygote_exec:file rx_file_perms; +# Allow zygote to write to statsd. +unix_socket_send(zygote, statsdw, statsd) + # Root fs. r_dir_file(zygote, rootfs) diff --git a/public/bootstat.te b/public/bootstat.te index ce14c2f739b956ae09e2abfb6d94621cdacdcb9b..a2a060bc25a81c52d75e9046693c03f98b9221ab 100644 --- a/public/bootstat.te +++ b/public/bootstat.te @@ -26,6 +26,9 @@ allow bootstat kernel:system syslog_read; # Allow access to reading the logs to read aspects of system health read_logd(bootstat) +# Allow bootstat write to statsd. +unix_socket_send(bootstat, statsdw, statsd) + # ToDo: end neverallow { diff --git a/public/lmkd.te b/public/lmkd.te index 54199e10afd91aeda18ad863ea174e0316f30862..0fc5d0f687901a357a6801ec1e0657ce7a2112b8 100644 --- a/public/lmkd.te +++ b/public/lmkd.te @@ -49,6 +49,9 @@ allow lmkd proc_sysrq:file rw_file_perms; # Read /proc/meminfo allow lmkd proc_meminfo:file r_file_perms; +# Allow lmkd to write to statsd. +unix_socket_send(lmkd, statsdw, statsd) + ### neverallow rules # never honor LD_PRELOAD diff --git a/public/statsd.te b/public/statsd.te index 384ce8a5924036b5db00a9ccba729fcd678a0f3f..603ee140e6bb1413503edfb444ec17d4e6a33337 100644 --- a/public/statsd.te +++ b/public/statsd.te @@ -67,10 +67,7 @@ allow statsd adbd:fd use; allow statsd adbd:unix_stream_socket { getattr read write }; allow statsd shell:fifo_file { getattr read }; -unix_socket_send(bootstat, statsdw, statsd) -unix_socket_send(lmkd, statsdw, statsd) unix_socket_send(statsd, statsdw, statsd) -unix_socket_send(system_server, statsdw, statsd) ### ### neverallow rules