$ adb shell su -c dmesg | grep denied | audit2allow -vp out/target/product/ls990/root/sepolicy
#============= isolated_app ==============
# src="isolated_app" tgt="app_data_file" class="dir", perms="getattr"
# comm="dboxed_process0" exe="" path=""
allow isolated_app app_data_file:dir getattr;
# src="isolated_app" tgt="shell_data_file" class="dir", perms="search"
# comm="dboxed_process0" exe="" path=""
allow isolated_app shell_data_file:dir search;
#============= logd ==============
# src="logd" tgt="logd" class="capability", perms="{ dac_override dac_read_search }"
# comm="logd" exe="" path=""
allow logd self:capability { dac_override dac_read_search };
#============= zygote ==============
# src="zygote" tgt="zygote" class="capability", perms="sys_nice"
# comm="main" exe="" path=""
allow zygote self:capability sys_nice;
$ adb shell su -c dmesg | grep denied
[ 5.483119] type=1400 audit(218400.860:4): avc: denied { write } for pid=1 comm="init" name="tracing_on" dev="debugfs" ino=3224 scontext=u:r:init:s0 tcontext=u:object_r:debugfs:s0 tclass=file permissive=0
[ 5.483324] init: write_file: Unable to open '/sys/kernel/debug/tracing/tracing_on': Permission denied
[ 59.046971] type=1400 audit(1484983807.720:5): avc: denied { read } for pid=2742 comm=576861747341707020576F726B6572 name="traces.txt" dev="mmcblk0p43" ino=1038338 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:anr_data_file:s0 tclass=file permissive=0
[ 59.048136] type=1400 audit(1484983807.720:6): avc: denied { read } for pid=2742 comm=576861747341707020576F726B6572 name="traces.txt" dev="mmcblk0p43" ino=1038338 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:anr_data_file:s0 tclass=file permissive=0
[ 65.785171] type=1400 audit(1484983814.457:7): avc: denied { unlink } for pid=3275 comm="Thread-17" name="log" dev="mmcblk0p42" ino=15522 scontext=u:r:system_server:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=0
[ 65.831496] type=1400 audit(1484983814.457:8): avc: denied { unlink } for pid=3275 comm="Thread-17" name=".version" dev="mmcblk0p42" ino=15523 scontext=u:r:system_server:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=0
[ 65.842044] type=1400 audit(1484983814.457:9): avc: denied { unlink } for pid=3275 comm="Thread-17" name="recovery.fstab" dev="mmcblk0p42" ino=15524 scontext=u:r:system_server:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=0
[ 65.842305] type=1400 audit(1484983814.457:10): avc: denied { unlink } for pid=3275 comm="Thread-17" name="storage.fstab" dev="mmcblk0p42" ino=15525 scontext=u:r:system_server:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=0
[ 65.842504] type=1400 audit(1484983814.457:11): avc: denied { unlink } for pid=3275 comm="Thread-17" name="intent" dev="mmcblk0p42" ino=15527 scontext=u:r:system_server:s0 tcontext=u:object_r:unlabeled:s0 tclass=file permissive=0
[ 83.890853] type=1400 audit(1484983832.560:12): avc: denied { read } for pid=4273 comm="Binder:4260_2" name="/" dev="tmpfs" ino=8195 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=0
[ 113.920964] type=1400 audit(1484983863.805:16): avc: denied { read } for pid=6734 comm="Binder:6721_1" name="/" dev="tmpfs" ino=8195 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=0
[ 121.217628] type=1400 audit(1484983871.102:17): avc: denied { read } for pid=6735 comm="Binder:6721_2" name="/" dev="tmpfs" ino=8195 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=0
[ 217.743053] type=1400 audit(1484983967.625:18): avc: denied { read } for pid=6735 comm="Binder:6721_2" name="/" dev="tmpfs" ino=8195 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=0
[ 467.206999] type=1400 audit(1485660430.919:11): avc: denied { getattr } for pid=3518 comm="m.android.phone" path="/data/user_de/0/com.android.settings" dev="mmcblk0p43" ino=900563 scontext=u:r:radio:s0 tcontext=u:object_r:system_app_data_file:s0 tclass=dir permissive=0
cache -> /dev/block/mmcblk0p42
userdata -> /dev/block/mmcblk0p43
Comments