platform_system_sepolicy/public/adbd.te

# adbd seclabel is specified in init.rc since
# it lives in the rootfs and has no unique file type.
type adbd, domain;
type adbd_exec, exec_type, file_type, system_file_type;

# Only init is allowed to enter the adbd domain via exec()
neverallow { domain -init } adbd:process transition;
neverallow * adbd:process dyntransition;

# Access /data/local/tests.
allow adbd shell_test_data_file:dir create_dir_perms;
allow adbd shell_test_data_file:file create_file_perms;
allow adbd shell_test_data_file:lnk_file create_file_perms;
SE Android policy. 2012-01-04 18:33:27 +01:00			`# adbd seclabel is specified in init.rc since`
			`# it lives in the rootfs and has no unique file type.`
Move adbd policy to private This leaves only the existence of adbd domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with adbd_current except those created by other domains' allow rules referencing adbd domain from public and vendor policies. Bug: 31364497 Change-Id: Icdce8b89f67c70c6c4c116471aaa412e55028cd8 2017-02-07 18:55:05 +01:00			`type adbd, domain;`
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5 2018-09-27 19:21:37 +02:00			`type adbd_exec, exec_type, file_type, system_file_type;`
Revert "Revert "Reduce the number of processes that can start adbd"" This reverts commit b5dc6137adf0c5ced252c6bedc48b00317e0a4e0. Reason for revert: Reverted incorrect change Change-Id: Ieafa3338e28ffeed40bcceb73486cffbfbd08b9d 2018-06-26 21:52:21 +02:00
			`# Only init is allowed to enter the adbd domain via exec()`
			`neverallow { domain -init } adbd:process transition;`
			`neverallow * adbd:process dyntransition;`
Add shell_test_data_file for /data/local/tests Add a domain for /data/local/tests which will be used by atest to execute tests on devices as shell or root. Bug: 138450837 Test: atest binderVendorDoubleLoadTest memunreachable_unit_test memunreachable_binder_test Change-Id: Ia34314bd9430e21c8b3304ac079e3d9b5705e19c 2020-09-01 01:11:11 +02:00
			`# Access /data/local/tests.`
			`allow adbd shell_test_data_file:dir create_dir_perms;`
			`allow adbd shell_test_data_file:file create_file_perms;`
			`allow adbd shell_test_data_file:lnk_file create_file_perms;`