platform_system_sepolicy/shell.te

# Domain for shell processes spawned by ADB
type shell, domain, shelldomain, mlstrustedsubject;
type shell_exec, exec_type, file_type;

# Create and use network sockets.
net_domain(shell)

# Run app_process.
# XXX Transition into its own domain?
app_domain(shell)

userdebug_or_eng(`
  # userdebug/eng shell is also permissive to permit setenforce.
  permissive shell;
')

# inherits from shelldomain.te
SELinux policy that separates "init_shell" from "shell". "init_shell" is used for shell processes spawned by init. Change-Id: I9e35d485bac91f3d0e4f3704acdbb9af7d617173 2013-05-06 22:24:27 +02:00			`# Domain for shell processes spawned by ADB`
Confine shell domain in -user builds only. Confine the domain for an adb shell in -user builds only. The shell domain in non-user builds is left permissive. init_shell (shell spawned by init, e.g. console service) remains unconfined by this change. Introduce a shelldomain attribute for rules common to all shell domains, assign it to the shell types, and add shelldomain.te for its rules. Change-Id: I01ee2c7ef80b61a9db151abe182ef9af7623c461 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-23 19:25:53 +02:00			`type shell, domain, shelldomain, mlstrustedsubject;`
Make sure exec_type is assigned to all entrypoint types. Some file types used as domain entrypoints were missing the exec_type attribute. Add it and add a neverallow rule to keep it that way. Change-Id: I7563f3e03940a27ae40ed4d6bb74181c26148849 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-09-27 16:38:14 +02:00			`type shell_exec, exec_type, file_type;`
SE Android policy. 2012-01-04 18:33:27 +01:00
Remove ping domain. ping in Android no longer requires any additional privileges beyond the caller. Drop the ping domain and executable file type entirely. Also add net_domain() to shell domain so that it can create and use network sockets. Change-Id: If51734abe572aecf8f510f1a55782159222e5a67 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2014-01-07 18:47:10 +01:00			`# Create and use network sockets.`
			`net_domain(shell)`

SE Android policy. 2012-01-04 18:33:27 +01:00			`# Run app_process.`
Confine shell domain in -user builds only. Confine the domain for an adb shell in -user builds only. The shell domain in non-user builds is left permissive. init_shell (shell spawned by init, e.g. console service) remains unconfined by this change. Introduce a shelldomain attribute for rules common to all shell domains, assign it to the shell types, and add shelldomain.te for its rules. Change-Id: I01ee2c7ef80b61a9db151abe182ef9af7623c461 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-23 19:25:53 +02:00			`# XXX Transition into its own domain?`
SE Android policy. 2012-01-04 18:33:27 +01:00			`app_domain(shell)`
Restrict the ability to set SELinux enforcing mode to init. Also make su and shell permissive in non-user builds to allow use of setenforce without violating the neverallow rule. Change-Id: Ie76ee04e90d5a76dfaa5f56e9e3eb7e283328a3f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-12-02 20:18:11 +01:00
Create new conditional userdebug_or_eng Create a new m4 macro called userdebug_or_eng. Arguments passed to this macro are only emitted if we're performing a userdebug or eng build. Merge shell.te and shell_user.te and eliminate duplicate lines. Same for su.te and su_user.te Change-Id: I8fbabca65ec392aeafd5b90cef57b5066033fad0 2014-01-10 00:25:36 +01:00			userdebug_or_eng(`
			`# userdebug/eng shell is also permissive to permit setenforce.`
			`permissive shell;`
			`')`
Support run-as and ndk-gdb functionality. Confine run-as (but leave permissive for now) and add other allow rules required for the use of run-as and ndk-gdb functionality. Change-Id: Ifae38233c091cd34013e98830d72aac4c4adcae0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-29 19:42:39 +01:00
Confine shell domain in -user builds only. Confine the domain for an adb shell in -user builds only. The shell domain in non-user builds is left permissive. init_shell (shell spawned by init, e.g. console service) remains unconfined by this change. Introduce a shelldomain attribute for rules common to all shell domains, assign it to the shell types, and add shelldomain.te for its rules. Change-Id: I01ee2c7ef80b61a9db151abe182ef9af7623c461 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-23 19:25:53 +02:00			`# inherits from shelldomain.te`