Define debuggerd class, permissions, and rules.

Define a new class, permissions, and rules for the debuggerd
SELinux MAC checks.

Used by Ib317564e54e07cc21f259e75124b762ad17c6e16 for debuggerd.

Change-Id: I8e120d319512ff207ed22ed87cde4e0432a13dda
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

access_vectors

@@ -915,3 +915,9 @@ class keystore_key
 	duplicate
 	clear_uid
 }
+
+class debuggerd
+{
+	dump_tombstone
+	dump_backtrace
+}

debuggerd.te

@@ -9,7 +9,7 @@ allow debuggerd self:capability2 { syslog };
 allow debuggerd domain:dir r_dir_perms;
 allow debuggerd domain:file r_file_perms;
 allow debuggerd domain:lnk_file read;
-allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process ptrace;
+allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process { ptrace getattr };
 security_access_policy(debuggerd)
 allow debuggerd system_data_file:dir create_dir_perms;
 allow debuggerd system_data_file:dir relabelfrom;
@@ -31,3 +31,6 @@ userdebug_or_eng(`
 
 # logd access
 read_logd(debuggerd)
+
+# Check SELinux permissions.
+selinux_check_access(debuggerd)

security_classes

@@ -143,4 +143,7 @@ class service_manager           # userspace
 # Keystore Key
 class keystore_key              # userspace
 
+# debuggerd service
+class debuggerd                 # userspace
+
 # FLASK

system_server.te

@@ -127,6 +127,9 @@ binder_call(system_server, appdomain)
 binder_call(system_server, dumpstate)
 binder_service(system_server)
 
+# Ask debuggerd to dump backtraces for native stacks of interest.
+allow system_server { mediaserver sdcardd surfaceflinger inputflinger }:debuggerd dump_backtrace;
+
 # Read /proc/pid files for dumping stack traces of native processes.
 r_dir_file(system_server, mediaserver)
 r_dir_file(system_server, sdcardd)