Skip to content
Snippets Groups Projects
Select Git revision
  • c6a28f0cb2368922e199d6a46a20180881f50dc7
  • master default protected
  • android-7.1.2_r28_klist
  • pie-cts-release
  • pie-vts-release
  • pie-cts-dev
  • oreo-mr1-iot-release
  • sdk-release
  • oreo-m6-s4-release
  • oreo-m4-s12-release
  • pie-release
  • pie-r2-release
  • pie-r2-s1-release
  • oreo-vts-release
  • oreo-cts-release
  • oreo-dev
  • oreo-mr1-dev
  • pie-gsi
  • pie-platform-release
  • pie-dev
  • oreo-cts-dev
  • android-o-mr1-iot-release-1.0.4
  • android-9.0.0_r8
  • android-9.0.0_r7
  • android-9.0.0_r6
  • android-9.0.0_r5
  • android-8.1.0_r46
  • android-8.1.0_r45
  • android-n-iot-release-smart-display-r2
  • android-vts-8.1_r5
  • android-cts-8.1_r8
  • android-cts-8.0_r12
  • android-cts-7.1_r20
  • android-cts-7.0_r24
  • android-o-mr1-iot-release-1.0.3
  • android-cts-9.0_r1
  • android-8.1.0_r43
  • android-8.1.0_r42
  • android-n-iot-release-smart-display
  • android-p-preview-5
  • android-9.0.0_r3
41 results

Android.mk

Blame
  • shell.te 2.59 KiB
    # Domain for shell processes spawned by ADB or console service.
    type shell, domain, mlstrustedsubject;
    type shell_exec, exec_type, file_type;
    
    # Create and use network sockets.
    net_domain(shell)
    
    # Run app_process.
    # XXX Transition into its own domain?
    app_domain(shell)
    
    # logcat
    read_logd(shell)
    control_logd(shell)
    # logcat -L (directly, or via dumpstate)
    allow shell pstorefs:dir search;
    allow shell pstorefs:file r_file_perms;
    
    # read files in /data/anr
    allow shell anr_data_file:dir r_dir_perms;
    allow shell anr_data_file:file r_file_perms;
    
    # Access /data/local/tmp.
    allow shell shell_data_file:dir create_dir_perms;
    allow shell shell_data_file:file create_file_perms;
    allow shell shell_data_file:file rx_file_perms;
    allow shell shell_data_file:lnk_file create_file_perms;
    
    # adb bugreport
    unix_socket_connect(shell, dumpstate, dumpstate)
    
    allow shell devpts:chr_file rw_file_perms;
    allow shell tty_device:chr_file rw_file_perms;
    allow shell console_device:chr_file rw_file_perms;
    allow shell input_device:dir r_dir_perms;
    allow shell input_device:chr_file rw_file_perms;
    allow shell system_file:file x_file_perms;
    allow shell shell_exec:file rx_file_perms;
    allow shell zygote_exec:file rx_file_perms;
    
    r_dir_file(shell, apk_data_file)
    
    # Set properties.
    unix_socket_connect(shell, property, init)
    allow shell shell_prop:property_service set;
    allow shell ctl_dumpstate_prop:property_service set;
    allow shell debug_prop:property_service set;
    allow shell powerctl_prop:property_service set;
    
    # systrace support - allow atrace to run
    # debugfs doesn't support labeling individual files, so we have
    # to grant read access to all of /sys/kernel/debug.
    # Directory read access and file write access is already granted
    # in domain.te.
    allow shell debugfs:file r_file_perms;
    
    # allow shell to run dmesg
    allow shell kernel:system syslog_read;
    
    # allow shell access to services
    allow shell servicemanager:service_manager list;
    # don't allow shell to access GateKeeper service
    allow shell { service_manager_type -gatekeeper_service }:service_manager find;
    service_manager_local_audit_domain(shell)
    
    # allow shell to look through /proc/ for ps, top
    allow shell domain:dir { search open read getattr };
    allow shell domain:{ file lnk_file } { open read getattr };
    
    # allow shell to read /proc/pid/attr/current for ps -Z
    allow shell domain:process getattr;
    
    # enable shell domain to read/write files/dirs for bootchart data
    # User will creates the start and stop file via adb shell
    # and read other files created by init process under /data/bootchart
    allow shell bootchart_data_file:dir rw_dir_perms;
    allow shell bootchart_data_file:file create_file_perms;