platform_system_sepolicy/init_shell.te

# Restricted domain for shell processes spawned by init
type init_shell, domain, shelldomain;
domain_auto_trans(init, shell_exec, init_shell)
unconfined_domain(init_shell)

# inherits from shelldomain.te
SELinux policy that separates "init_shell" from "shell". "init_shell" is used for shell processes spawned by init. Change-Id: I9e35d485bac91f3d0e4f3704acdbb9af7d617173 2013-05-06 22:24:27 +02:00			`# Restricted domain for shell processes spawned by init`
Confine shell domain in -user builds only. Confine the domain for an adb shell in -user builds only. The shell domain in non-user builds is left permissive. init_shell (shell spawned by init, e.g. console service) remains unconfined by this change. Introduce a shelldomain attribute for rules common to all shell domains, assign it to the shell types, and add shelldomain.te for its rules. Change-Id: I01ee2c7ef80b61a9db151abe182ef9af7623c461 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-23 19:25:53 +02:00			`type init_shell, domain, shelldomain;`
SELinux policy that separates "init_shell" from "shell". "init_shell" is used for shell processes spawned by init. Change-Id: I9e35d485bac91f3d0e4f3704acdbb9af7d617173 2013-05-06 22:24:27 +02:00			`domain_auto_trans(init, shell_exec, init_shell)`
Make all domains unconfined. This prevents denials from being generated by the base policy. Over time, these rules will be incrementally tightened to improve security. Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11 2013-05-18 02:11:29 +02:00			`unconfined_domain(init_shell)`
Confine shell domain in -user builds only. Confine the domain for an adb shell in -user builds only. The shell domain in non-user builds is left permissive. init_shell (shell spawned by init, e.g. console service) remains unconfined by this change. Introduce a shelldomain attribute for rules common to all shell domains, assign it to the shell types, and add shelldomain.te for its rules. Change-Id: I01ee2c7ef80b61a9db151abe182ef9af7623c461 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-23 19:25:53 +02:00
			`# inherits from shelldomain.te`