Skip to content
Snippets Groups Projects
Normal view Permalink
shell.te 325 B
Newer Older
  • Learn to ignore specific revisions
    • Alex Klyubin's avatar
    SELinux policy that separates "init_shell" from "shell".  
    Alex Klyubin committed
    1 
    # Domain for shell processes spawned by ADB
    Stephen Smalley's avatar
    Confine shell domain in -user builds only.  
    Stephen Smalley committed
    2 
    type shell, domain, shelldomain, mlstrustedsubject;
    Stephen Smalley's avatar
    Make sure exec_type is assigned to all entrypoint types.  
    Stephen Smalley committed
    3 
    type shell_exec, exec_type, file_type;
    Stephen Smalley's avatar
    SE Android policy.
    Stephen Smalley committed
    4 5 
    
# Run app_process.
    Stephen Smalley's avatar
    Confine shell domain in -user builds only.  
    Stephen Smalley committed
    6 
    # XXX Transition into its own domain?
    Stephen Smalley's avatar
    SE Android policy.
    Stephen Smalley committed
    7 
    app_domain(shell)
    Stephen Smalley's avatar
    Restrict the ability to set SELinux enforcing mode to init.  
    Stephen Smalley committed
    8
    Stephen Smalley's avatar
    Confine shell domain in -user builds only.  
    Stephen Smalley committed
    9 
    # userdebug/eng shell is also permissive to permit setenforce.
    Stephen Smalley's avatar
    Restrict the ability to set SELinux enforcing mode to init.  
    Stephen Smalley committed
    10 
    permissive shell;
    Stephen Smalley's avatar
    Support run-as and ndk-gdb functionality.  
    Stephen Smalley committed
    11
    Stephen Smalley's avatar
    Confine shell domain in -user builds only.  
    Stephen Smalley committed
    12 
    # inherits from shelldomain.te