I have a custom A10 repo in which I'm trying to create an app that would be able to read /proc/[pid]/some-file
files e.g. stat
and status
, kind of like ps
does.
Having read this answer it was clear that a AID_READPROC
should be added which I have done using a custom permission.
<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
package="com.poke.mon"
android:sharedUserId="android.uid.system">
<!-- More stuff -->
<uses-permission android:name="com.poke.READPROC_PERM" />
<!-- More stuff -->
</application>
</manifest>
I have added com.poke.READPROC_PERM
by editing the appropriate platform.xml
, AndroidManifest.xml
and sytem-current.txt
files and allowing that permission in the privapp-permissions
file
I have validated by cat
-ing the status
file for my app's process and verifying that gid 3009 is indeed present.
However I was still being blocked by sepolicy (with the enforcement disabled the code could access the files).
Adding r_dir_file(priv_app, proc)
to the priv_app.te
resulted in errors.
The reason given by the compiler was this line in coredomain.te
:
# Core domains are not permitted to use kernel interfaces which are not
# explicitly labeled.
# TODO(b/65643247): Apply these neverallow rules to all coredomain.
full_treble_only(`
# /proc
neverallow {
coredomain
-init
-vold
} proc:file no_rw_file_perms;
Creating a custom domain resulted in similar errors as I probably want to
typeattribute my_apps_domain coredomain;
To avoid a lot of complexity and duplication (I need to communicate with other services etc.).
Is there a way to work around that limitation? (e.g. looking at genfscon
it doesn't seem to support wildchar mapping e.g. /proc/\d+/some-file
)
It also seems weird that shell
is able to do ps
just fine yet it's also coredomain
defined by the first line of shell.te
:
typeattribute shell coredomain;
So maybe there's some other magical sepolicy door I'm missing?
avc
denials fromdmesg
into SEPolicy rules and inject them during runtime using Magisk'ssupoliy
tool. My existing answers may help: android.stackexchange.com/search?q=user%3A218526+supolicy – Irfan Latif Feb 23 at 14:30audit2allow
to generate the new rules but as I mentioned the build says they contradict some neverallow rule – Darius Feb 23 at 18:53