platform_system_sepolicy/public/init.te

# init is its own domain.
type init, domain, mlstrustedsubject;
type init_exec, system_file_type, exec_type, file_type;
type init_tmpfs, file_type;
Revert "Revert "SELinux policy changes for re-execing init."" This reverts commit c450759e8e67caa7a77ca078b1478b018a9b848b. There was nothing wrong with this change originally --- the companion change in init was broken. Bug: http://b/19702273 Change-Id: I9d806f6ac251734a61aa90c0741bec7118ea0387 2015-04-24 20:38:10 +02:00			`# init is its own domain.`
init.te: remove domain_deprecated auditallows have been in place for a while, and no obvious denials. Remove domain_deprecated from init.te While I'm here, clean up the formatting of the lines in domain_deprecated.te. Bug: 28760354 Test: policy compiles and device boots. No obvious problems. Change-Id: Ia12e77c3e25990957abf15744e083eed9ffbb056 2017-02-10 21:06:46 +01:00			`type init, domain, mlstrustedsubject;`
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5 2018-09-27 19:21:37 +02:00			`type init_exec, system_file_type, exec_type, file_type;`
Properly Treble-ize tmpfs access This is being done in preparation for the migration from ashmem to memfd. In order for tmpfs objects to be usable across the Treble boundary, they need to be declared in public policy whereas, they're currently all declared in private policy as part of the tmpfs_domain() macro. Remove the type declaration from the macro, and remove tmpfs_domain() from the init_daemon_domain() macro to avoid having to declare the *_tmpfs types for all init launched domains. tmpfs is mostly used by apps and the media frameworks. Bug: 122854450 Test: Boot Taimen and blueline. Watch videos, make phone calls, browse internet, send text, install angry birds...play angry birds, keep playing angry birds... Change-Id: I20a47d2bb22e61b16187015c7bc7ca10accf6358 2019-01-24 00:07:40 +01:00			`type init_tmpfs, file_type;`