diff --git a/private/incidentd.te b/private/incidentd.te index 7ad3a30c22b3da799c8c419fa38385fde8017125..658db0710e24aa1f69b3586f7c244ea67a45f5ca 100644 --- a/private/incidentd.te +++ b/private/incidentd.te @@ -45,6 +45,10 @@ allow incidentd sysfs_batteryinfo:file r_file_perms; userdebug_or_eng(`allow incidentd pstorefs:dir search'); userdebug_or_eng(`allow incidentd pstorefs:file r_file_perms'); +# section id 3023, allow obtaining stats report +allow incidentd stats_service:service_manager find; +binder_call(incidentd, statsd) + # Create and write into /data/misc/incidents allow incidentd incident_data_file:dir rw_dir_perms; allow incidentd incident_data_file:file create_file_perms; diff --git a/private/stats.te b/private/stats.te index 818d9f9d34f65835167f700a94a001d73ae42afa..2c7199df9ba4f6dc01daf840f83e524ec54c0c35 100644 --- a/private/stats.te +++ b/private/stats.te @@ -37,10 +37,10 @@ binder_call(statsd, stats) ### neverallow rules ### -# Only system_server, system_app, traceur_app, and stats command can find the stats service. neverallow { domain -dumpstate + -incidentd -priv_app -shell -stats diff --git a/private/statsd.te b/private/statsd.te index 1e4c5b392cb04cffadfe1c3cdb2f80813764c588..16d3aebadbf30c99b7b2f6325575cf5d1d87ec7b 100644 --- a/private/statsd.te +++ b/private/statsd.te @@ -14,3 +14,6 @@ domain_auto_trans(statsd, perfetto_exec, perfetto) allow statsd { statscompanion_service }:service_manager find; + +# Allow incidentd to obtain the statsd incident section. +allow statsd incidentd:fifo_file write;