platform_system_sepolicy/public/adbd.te

# adbd seclabel is specified in init.rc since
# it lives in the rootfs and has no unique file type.
type adbd, domain;
type adbd_exec, exec_type, file_type, system_file_type;

# Only init is allowed to enter the adbd domain via exec()
neverallow { domain -init } adbd:process transition;
neverallow * adbd:process dyntransition;
SE Android policy. 2012-01-04 18:33:27 +01:00			`# adbd seclabel is specified in init.rc since`
			`# it lives in the rootfs and has no unique file type.`
Move adbd policy to private This leaves only the existence of adbd domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with adbd_current except those created by other domains' allow rules referencing adbd domain from public and vendor policies. Bug: 31364497 Change-Id: Icdce8b89f67c70c6c4c116471aaa412e55028cd8 2017-02-07 18:55:05 +01:00			`type adbd, domain;`
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5 2018-09-27 19:21:37 +02:00			`type adbd_exec, exec_type, file_type, system_file_type;`
Revert "Revert "Reduce the number of processes that can start adbd"" This reverts commit b5dc6137adf0c5ced252c6bedc48b00317e0a4e0. Reason for revert: Reverted incorrect change Change-Id: Ieafa3338e28ffeed40bcceb73486cffbfbd08b9d 2018-06-26 21:52:21 +02:00
			`# Only init is allowed to enter the adbd domain via exec()`
			`neverallow { domain -init } adbd:process transition;`
			`neverallow * adbd:process dyntransition;`