platform_system_sepolicy/init.te

# init switches to init domain (via init.rc).
type init, domain;
permissive init;
# init is unconfined.
unconfined_domain(init)
tmpfs_domain(init)
# add a rule to handle unlabelled mounts
allow init unlabeled:filesystem mount;
SE Android policy. 2012-01-04 18:33:27 +01:00			`# init switches to init domain (via init.rc).`
			`type init, domain;`
Move domains into per-domain permissive mode. Bug: 4070557 Change-Id: I027f76cff6df90e9909711cb81fbd17db95233c1 2013-05-15 06:02:55 +02:00			`permissive init;`
SE Android policy. 2012-01-04 18:33:27 +01:00			`# init is unconfined.`
			`unconfined_domain(init)`
			`tmpfs_domain(init)`
Make all domains unconfined. This prevents denials from being generated by the base policy. Over time, these rules will be incrementally tightened to improve security. Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11 2013-05-18 02:11:29 +02:00			`# add a rule to handle unlabelled mounts`
			`allow init unlabeled:filesystem mount;`