logd: logpersistd
- Enable logpersistd to write to /data/misc/logd
- Enable logpersistd to read from pstore to help complete any content
lost by reboot disruption
- Enable shell readonly ability logpersistd files in /data/misc/logd
- Enable logcat -f when placed into logd context to act as a
logpersistd (nee logcatd) agent, restrict access to run only in
userdebug or eng
Bug: 19608716
Change-Id: I3209582bc796a1093c325c90068a48bf268e5ab5
diff --git a/file.te b/file.te
index 28076f5..0e08a38 100644
--- a/file.te
+++ b/file.te
@@ -165,6 +165,7 @@
type logdw_socket, file_type, mlstrustedobject;
type mdns_socket, file_type;
type mdnsd_socket, file_type, mlstrustedobject;
+type misc_logd_file, file_type;
type mtpd_socket, file_type;
type netd_socket, file_type;
type property_socket, file_type;
diff --git a/file_contexts b/file_contexts
index cc152f6..5ca2852 100644
--- a/file_contexts
+++ b/file_contexts
@@ -236,6 +236,7 @@
/data/misc/gatekeeper(/.*)? u:object_r:gatekeeper_data_file:s0
/data/misc/keychain(/.*)? u:object_r:keychain_data_file:s0
/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0
+/data/misc/logd(/.*)? u:object_r:misc_logd_file:s0
/data/misc/media(/.*)? u:object_r:media_data_file:s0
/data/misc/net(/.*)? u:object_r:net_data_file:s0
/data/misc/shared_relro(/.*)? u:object_r:shared_relro_file:s0
diff --git a/init.te b/init.te
index 3af01fb..34b010c 100644
--- a/init.te
+++ b/init.te
@@ -161,6 +161,10 @@
domain_trans(init, shell_exec, shell)
domain_trans(init, init_exec, ueventd)
domain_trans(init, init_exec, watchdogd)
+# case where logpersistd is actually logcat -f in logd context (nee: logcatd)
+userdebug_or_eng(`
+ domain_auto_trans(init, logcat_exec, logd)
+')
# Support "adb shell stop"
allow init self:capability kill;
diff --git a/logd.te b/logd.te
index 8c28b48..b0d978f 100644
--- a/logd.te
+++ b/logd.te
@@ -10,6 +10,10 @@
allow logd kernel:system syslog_read;
allow logd kmsg_device:chr_file w_file_perms;
allow logd system_data_file:file r_file_perms;
+allow logd misc_logd_file:file create_file_perms;
+allow logd misc_logd_file:dir rw_dir_perms;
+allow logd pstorefs:dir search;
+allow logd pstorefs:file r_file_perms;
r_dir_file(logd, domain)
@@ -17,6 +21,11 @@
control_logd(logd)
+# case where logpersistd is actually logcat -f in logd context (nee: logcatd)
+userdebug_or_eng(`
+ unix_socket_connect(logd, logdr, logd)
+')
+
###
### Neverallow rules
###
diff --git a/shell.te b/shell.te
index c55ce3e..ac55346 100644
--- a/shell.te
+++ b/shell.te
@@ -15,6 +15,9 @@
# logcat -L (directly, or via dumpstate)
allow shell pstorefs:dir search;
allow shell pstorefs:file r_file_perms;
+# logpersistd (nee logcatd) files
+allow shell misc_logd_file:dir r_dir_perms;
+allow shell misc_logd_file:file r_file_perms;
# read files in /data/anr
allow shell anr_data_file:dir r_dir_perms;
