platform_system_sepolicy/init.te

# init switches to init domain (via init.rc).
type init, domain;
# init is unconfined.
unconfined_domain(init)
tmpfs_domain(init)
relabelto_domain(init)
# add a rule to handle unlabelled mounts
allow init unlabeled:filesystem mount;

allow init {fs_type dev_type file_type}:dir_file_class_set relabelto;
allow init kernel:security { load_policy setenforce };
SE Android policy. 2012-01-04 18:33:27 +01:00			`# init switches to init domain (via init.rc).`
			`type init, domain;`
			`# init is unconfined.`
			`unconfined_domain(init)`
			`tmpfs_domain(init)`
domain.te: Add backwards compatibility for unlabeled files For unlabeled files, revert to DAC rules. This is for backwards compatibility, as files created before SELinux was in place may not be properly labeled. Over time, the number of unlabeled files will decrease, and we can (hopefully) remove this rule in the future. To prevent inadvertantly introducing the "relabelto" permission, add a neverallow domain, and add apps which have a legitimate need to relabel to this domain. Bug: 9777552 Change-Id: I71b0ff8abd4925432062007c45b5be85f6f70a88 2013-07-10 23:46:05 +02:00			`relabelto_domain(init)`
Make all domains unconfined. This prevents denials from being generated by the base policy. Over time, these rules will be incrementally tightened to improve security. Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11 2013-05-18 02:11:29 +02:00			`# add a rule to handle unlabelled mounts`
			`allow init unlabeled:filesystem mount;`
domain.te: Add backwards compatibility for unlabeled files For unlabeled files, revert to DAC rules. This is for backwards compatibility, as files created before SELinux was in place may not be properly labeled. Over time, the number of unlabeled files will decrease, and we can (hopefully) remove this rule in the future. To prevent inadvertantly introducing the "relabelto" permission, add a neverallow domain, and add apps which have a legitimate need to relabel to this domain. Bug: 9777552 Change-Id: I71b0ff8abd4925432062007c45b5be85f6f70a88 2013-07-10 23:46:05 +02:00
			`allow init {fs_type dev_type file_type}:dir_file_class_set relabelto;`
Restrict the ability to set SELinux enforcing mode to init. Also make su and shell permissive in non-user builds to allow use of setenforce without violating the neverallow rule. Change-Id: Ie76ee04e90d5a76dfaa5f56e9e3eb7e283328a3f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-12-02 20:18:11 +01:00			`allow init kernel:security { load_policy setenforce };`