1# Domain for atrace process. 2# It is spawned either by traced_probes or by init for the boottrace service. 3 4type atrace_exec, exec_type, file_type, system_file_type; 5 6# boottrace services uses /data/misc/boottrace/categories 7allow atrace boottrace_data_file:dir search; 8allow atrace boottrace_data_file:file r_file_perms; 9 10# Allow atrace to access tracefs. 11allow atrace debugfs_tracing:dir r_dir_perms; 12allow atrace debugfs_tracing:file rw_file_perms; 13allow atrace debugfs_trace_marker:file getattr; 14 15# Allow atrace to write data when a pipe is used for stdout/stderr. 16# This is used by Perfetto to capture atrace stdout/stderr. 17allow atrace traced_probes:fd use; 18allow atrace traced_probes:fifo_file { getattr write }; 19 20# atrace sets debug.atrace.* properties 21set_prop(atrace, debug_prop) 22 23# atrace pokes all the binder-enabled processes at startup with a 24# SYSPROPS_TRANSACTION, to tell them to reload the debug.atrace.* properties. 25 26# Allow discovery of binder services. 27allow atrace { 28 service_manager_type 29 -apex_service 30 -dnsresolver_service 31 -dumpstate_service 32 -incident_service 33 -installd_service 34 -lpdump_service 35 -mdns_service 36 -netd_service 37 -stats_service 38 -tracingproxy_service 39 -vold_service 40 -default_android_service 41}:service_manager { find }; 42allow atrace servicemanager:service_manager list; 43 44# Allow notifying the processes hosting specific binder services that 45# trace-related system properties have changed. 46binder_use(atrace) 47allow atrace surfaceflinger:binder call; 48allow atrace system_server:binder call; 49allow atrace cameraserver:binder call; 50 51# Similarly, on debug builds, allow specific HALs to be notified that 52# trace-related system properties have changed. 53userdebug_or_eng(` 54 # List HAL interfaces. 55 allow atrace hwservicemanager:hwservice_manager list; 56 # Notify the camera HAL. 57 hal_client_domain(atrace, hal_camera) 58 hal_client_domain(atrace, hal_vibrator) 59') 60 61# Remove logspam from notification attempts to non-allowlisted services. 62dontaudit atrace hwservice_manager_type:hwservice_manager find; 63dontaudit atrace service_manager_type:service_manager find; 64dontaudit atrace domain:binder call; 65 66# atrace can call atrace HAL 67hal_client_domain(atrace, hal_atrace) 68 69get_prop(atrace, hwservicemanager_prop) 70 71userdebug_or_eng(` 72 # atrace is generally invoked as a standalone binary from shell or perf 73 # daemons like Perfetto traced_probes. However, in userdebug builds, there is 74 # a further option to run atrace as an init daemon for boot tracing. 75 init_daemon_domain(atrace) 76 77 allow atrace debugfs_tracing_debug:dir r_dir_perms; 78 allow atrace debugfs_tracing_debug:file rw_file_perms; 79') 80