From f99c74ccf8759c36f203e204743399c1e1ea9432 Mon Sep 17 00:00:00 2001
From: Jaekyun Seok <jaekyun@google.com>
Date: Fri, 6 Apr 2018 03:32:58 +0900
Subject: [PATCH] Allow dumpstate to read property_type
dumpstate needs to read all the system properties for debugging.
Bug: 77277669
Test: succeeded building and tested with taimen
Change-Id: I3603854b3be67d4fc55d74f7925a21bfa59c81ee
Merged-In: I3603854b3be67d4fc55d74f7925a21bfa59c81ee
(cherry picked from commit 4de238e9b999f91a86d130638a8b70d306363bf9)
---
public/domain.te | 2 +-
public/dumpstate.te | 12 ++----------
public/netd.te | 2 +-
3 files changed, 4 insertions(+), 12 deletions(-)
diff --git a/public/domain.te b/public/domain.te
index f0867a4c4..7c772b441 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -560,7 +560,7 @@ neverallow {
} serialno_prop:file r_file_perms;
# Do not allow reading the last boot timestamp from system properties
-neverallow { domain -init -system_server } firstboot_prop:file r_file_perms;
+neverallow { domain -init -system_server -dumpstate } firstboot_prop:file r_file_perms;
neverallow {
domain
diff --git a/public/dumpstate.te b/public/dumpstate.te
index 8906f5dcf..9d7743c3b 100644
--- a/public/dumpstate.te
+++ b/public/dumpstate.te
@@ -233,16 +233,8 @@ set_prop(dumpstate, exported_dumpstate_prop)
# dumpstate_options_prop is used to pass extra command-line args.
set_prop(dumpstate, dumpstate_options_prop)
-# Read device's serial number from system properties
-get_prop(dumpstate, serialno_prop)
-
-# Read state of logging-related properties
-get_prop(dumpstate, device_logging_prop)
-
-# Read state of boot reason properties
-get_prop(dumpstate, bootloader_boot_reason_prop)
-get_prop(dumpstate, last_boot_reason_prop)
-get_prop(dumpstate, system_boot_reason_prop)
+# Read any system properties
+get_prop(dumpstate, property_type)
# Access to /data/media.
# This should be removed if sdcardfs is modified to alter the secontext for its
diff --git a/public/netd.te b/public/netd.te
index 0e9e08ca7..18113e756 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -141,7 +141,7 @@ neverallow netd { appdomain userdebug_or_eng(`-su') }:binder call;
# persist.netd.stable_secret contains RFC 7217 secret key which should never be
# leaked to other processes. Make sure it never leaks.
-neverallow { domain -netd -init } netd_stable_secret_prop:file r_file_perms;
+neverallow { domain -netd -init -dumpstate } netd_stable_secret_prop:file r_file_perms;
# We want to ensure that no other process ever tries tampering with persist.netd.stable_secret,
# the RFC 7217 secret key managed by netd. Doing so could compromise user privacy.
--
GitLab