From 43a230198219634e29cb9216e97885f228c8b03a Mon Sep 17 00:00:00 2001
From: Enginex0 <enginex0@users.noreply.github.com>
Date: Fri, 26 Jun 2026 15:54:19 +0100
Subject: [PATCH] feat(soter): sepolicy grants for ptrace injection

Injection into the soterserver app (platform_app domain, per recon)
needs ptrace under SELinux enforcing. Add the grant mirroring the
keystore one, in the base rule so it applies to both variants:

  allow crash_dump platform_app process *

The per-UID NDJSON write grant is debug-only: appended for debug
builds in build.gradle.kts's isDebug doLast, mirroring the existing
keystore media_rw_data_file grant. Keeping it out of the base rule
stops an external-storage write from leaking into release.

No soter_server SELinux type exists; platform_app is the soterserver
app domain. Runtime policy (KSU/magiskpolicy) grants this past the
compile-time neverallow; on-device avc verification is 10.V.

Checkpoint 10.C.
---
 app/build.gradle.kts | 10 +++++++---
 module/sepolicy.rule |  4 ++++
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index d7bc295..64d484f 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -224,10 +224,14 @@ androidComponents {
 
                 if (isDebug) {
                     doLast {
-                        // Debug-only: grant the keystore domain external-storage access; diag.sh
-                        // (shipped only in debug) carries the shell side of the diagnostic plane.
+                        // Debug-only: grant the keystore + soterserver (platform_app) domains
+                        // external-storage access for the per-UID NDJSON sink. diag.sh (shipped
+                        // only in debug) carries the shell side of the diagnostic plane.
                         tempModuleDir.get().asFile.resolve("sepolicy.rule")
-                            .appendText("\nallow keystore media_rw_data_file { dir file } *\n")
+                            .appendText(
+                                "\nallow keystore media_rw_data_file { dir file } *" +
+                                    "\nallow platform_app media_rw_data_file { dir file } *\n",
+                            )
                     }
                 }
             }
diff --git a/module/sepolicy.rule b/module/sepolicy.rule
index fb5cbcd..4ded976 100644
--- a/module/sepolicy.rule
+++ b/module/sepolicy.rule
@@ -1,6 +1,10 @@
 allow keystore {adb_data_file shell_data_file} file *
 allow crash_dump keystore process *
 
+# SOTER Layer-A (10.C): ptrace inject into soterserver (platform_app). The debug NDJSON
+# media_rw_data_file grant is debug-only — appended for debug builds in app/build.gradle.kts.
+allow crash_dump platform_app process *
+
 allow ksu self:tcp_socket { create connect read write getopt setopt }
 allow ksu node:tcp_socket node_bind
 allow ksu port:tcp_socket name_connect