platform_system_sepolicy/runas.te

type runas, domain;
type runas_exec, file_type;
permissive runas;
unconfined_domain(runas)

# ndk-gdb invokes adb shell run-as.
domain_auto_trans(shell, runas_exec, runas)
Make all domains unconfined. This prevents denials from being generated by the base policy. Over time, these rules will be incrementally tightened to improve security. Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11 2013-05-18 02:11:29 +02:00			`type runas, domain;`
Add policy for run-as program. Add policy for run-as program and label it in file_contexts. Drop MLS constraints on local socket checks other than create/relabel as this interferes with connections with services, in particular for adb forward. Change-Id: Ib0c4abeb7cbef559e150a620c45a7c31e0531114 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2012-11-13 19:00:05 +01:00			`type runas_exec, file_type;`
Make all domains unconfined. This prevents denials from being generated by the base policy. Over time, these rules will be incrementally tightened to improve security. Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11 2013-05-18 02:11:29 +02:00			`permissive runas;`
			`unconfined_domain(runas)`
Add policy for run-as program. Add policy for run-as program and label it in file_contexts. Drop MLS constraints on local socket checks other than create/relabel as this interferes with connections with services, in particular for adb forward. Change-Id: Ib0c4abeb7cbef559e150a620c45a7c31e0531114 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2012-11-13 19:00:05 +01:00
			`# ndk-gdb invokes adb shell run-as.`
			`domain_auto_trans(shell, runas_exec, runas)`