Skip to content
Snippets Groups Projects
Commit 59e40a04 authored by Geremy Condra's avatar Geremy Condra Committed by Android (Google) Code Review
Browse files

Merge "SELinux policy that separates "init_shell" from "shell"." into jb-mr2-dev

parents c65b2ba3 8199123c
No related branches found
No related tags found
No related merge requests found
# Restricted domain for shell processes spawned by init
type init_shell, domain, mlstrustedsubject;
domain_auto_trans(init, shell_exec, init_shell)
allow init_shell rootfs:dir r_dir_perms;
allow init_shell devpts:chr_file rw_file_perms;
allow init_shell tty_device:chr_file rw_file_perms;
allow init_shell console_device:chr_file rw_file_perms;
allow init_shell input_device:chr_file rw_file_perms;
allow init_shell system_file:file x_file_perms;
allow init_shell shell_exec:file rx_file_perms;
allow init_shell zygote_exec:file rx_file_perms;
# setprop toolbox command
unix_socket_connect(init_shell, property, init)
# Domain for shell processes spawned by ADB
type shell, domain, mlstrustedsubject; type shell, domain, mlstrustedsubject;
type shell_exec, file_type; type shell_exec, file_type;
domain_auto_trans(init, shell_exec, shell)
allow shell rootfs:dir r_dir_perms; allow shell rootfs:dir r_dir_perms;
allow shell devpts:chr_file rw_file_perms; allow shell devpts:chr_file rw_file_perms;
allow shell tty_device:chr_file rw_file_perms; allow shell tty_device:chr_file rw_file_perms;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment