Skip to content
Snippets Groups Projects
Commit 1d61883a authored by Nick Kralevich's avatar Nick Kralevich Committed by android-build-merger
Browse files

Ensure only com.android.shell can run in the shell domain.

am: 714ee5f2

Change-Id: I3580b3e1ed28e31c41e221bc8697a90bdc70eca8
parents f9eb9314 714ee5f2
No related branches found
No related tags found
No related merge requests found
......@@ -91,6 +91,10 @@ neverallow user=((?!_isolated).)* domain=isolated_app
# uid's can be in shell domain
neverallow user=shell domain=((?!shell).)*
# only the package named com.android.shell can run in the shell domain
neverallow domain=shell name=((?!com\.android\.shell).)*
neverallow user=shell name=((?!com\.android\.shell).)*
# Ephemeral Apps must run in the ephemeral_app domain
neverallow isEphemeralApp=true domain=((?!ephemeral_app).)*
......@@ -100,7 +104,7 @@ user=bluetooth seinfo=platform domain=bluetooth type=bluetooth_data_file
user=nfc seinfo=platform domain=nfc type=nfc_data_file
user=radio seinfo=platform domain=radio type=radio_data_file
user=shared_relro domain=shared_relro
user=shell seinfo=platform domain=shell type=shell_data_file
user=shell seinfo=platform domain=shell name=com.android.shell type=shell_data_file
user=_isolated domain=isolated_app levelFrom=user
user=_app seinfo=media domain=mediaprovider name=android.process.media type=app_data_file levelFrom=user
user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment