b1d81645b3
Start running in enforcing mode for kernel / init. This should be mostly a no-op, as the kernel / init is in the unconfined domain. Change-Id: I8273d936c9a4eecb50b78ae93490a4dd52f59eb6
8 lines
245 B
Text
8 lines
245 B
Text
# Life begins with the kernel.
|
|
type kernel, domain;
|
|
# The kernel is unconfined.
|
|
unconfined_domain(kernel)
|
|
relabelto_domain(kernel)
|
|
|
|
allow kernel {fs_type dev_type file_type}:dir_file_class_set relabelto;
|
|
allow kernel unlabeled:filesystem mount;
|