title: Accessing `proc` file-system to read `/proc/[pid]/some-file` from a system app
body: <p>I have a custom A10 repo in which I'm trying to create an app that would be able to read <code>/proc/[pid]/some-file</code> files e.g. <code>stat</code> and <code>status</code>, kind of like <code>ps</code> does.</p>
  <p>Having read this <a href="https://android.stackexchange.com/a/207115/">answer</a> it was clear that a <code>AID_READPROC</code> should be added which I have done using a custom permission.</p>
  <pre><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot;?&gt;
  &lt;manifest xmlns:android=&quot;http://schemas.android.com/apk/res/android&quot;
      package=&quot;com.poke.mon&quot;
      android:sharedUserId=&quot;android.uid.system&quot;&gt;
  &lt;!-- More stuff --&gt;
           &lt;uses-permission android:name=&quot;com.poke.READPROC_PERM&quot; /&gt;
  &lt;!-- More stuff --&gt;
    &lt;/application&gt;
  &lt;/manifest&gt;
  </code></pre>
  <p>I have added <code>com.poke.READPROC_PERM</code> by editing the appropriate <code>platform.xml</code>, <code>AndroidManifest.xml</code> and <code>sytem-current.txt</code> files and allowing that permission in the <code>privapp-permissions</code> file</p>
  <p>I have validated by <code>cat</code>-ing the <code>status</code> file for my app's process and verifying that gid 3009 is indeed present.</p>
  <p>However I was still being blocked by sepolicy (with the enforcement disabled the code could access the files).</p>
  <p>Adding <code>r_dir_file(priv_app, proc)</code> to the <code>priv_app.te</code> resulted in errors.</p>
  <p>The reason given by the compiler was this <a href="https://cs.android.com/android/platform/superproject/+/android-10.0.0_r30:system/sepolicy/private/coredomain.te;l=91" rel="nofollow noreferrer">line</a> in <code>coredomain.te</code> :</p>
  <pre><code># Core domains are not permitted to use kernel interfaces which are not
  # explicitly labeled.
  # TODO(b/65643247): Apply these neverallow rules to all coredomain.
  full_treble_only(`
    # /proc
    neverallow {
      coredomain
      -init
      -vold
    } proc:file no_rw_file_perms;
  </code></pre>
  <p>Creating a custom domain resulted in similar errors as I probably want to</p>
  <pre><code>typeattribute my_apps_domain coredomain;
  </code></pre>
  <p>To avoid a lot of complexity and duplication (I need to communicate with other services etc.).</p>
  <p>Is there a way to work around that limitation? (e.g. looking at <code>genfscon</code> it doesn't seem to support wildchar mapping e.g. <code>/proc/\d+/some-file</code>)</p>
  <p>It also seems weird that <code>shell</code> is able to do <code>ps</code> just fine yet it's also <code>coredomain</code> defined by the <a href="https://cs.android.com/android/platform/superproject/+/android-10.0.0_r30:system/sepolicy/private/shell.te;l=1" rel="nofollow noreferrer">first line</a> of <code>shell.te</code>:</p>
  <pre><code>typeattribute shell coredomain;
  </code></pre>
  <p>So maybe there's some other magical sepolicy door I'm missing?</p>