| type perfd, domain, domain_deprecated; |
| type perfd_exec, exec_type, file_type; |
| |
| init_daemon_domain(perfd) |
| |
| allow perfd cameraserver:process signull; |
| |
| allow perfd perfd_data_file:dir rw_dir_perms; |
| allow perfd perfd_data_file:file create_file_perms; |
| allow perfd perfd_data_file:sock_file create_file_perms; |
| |
| allow perfd sysfs_performance:dir r_dir_perms; |
| allow perfd sysfs_performance:file rw_file_perms; |
| allow perfd proc_kernel_sched:file rw_file_perms; |
| |
| allow perfd sysfs_thermal:dir search; |
| allow perfd sysfs_thermal:file rw_file_perms; |
| |
| allow perfd sysfs_power_management:file w_file_perms; |
| |
| # allow writing to /sys/devices/system/cpu/* |
| allow perfd sysfs_devices_system_cpu:file rw_file_perms; |
| |
| # perfd uses kill(pid, 0) to determine if a process exists. |
| # Determining if a process exists does not require the kill capability |
| # since a permission denied indicates the process exists. |
| dontaudit perfd self:capability kill; |
