7d0f955ef0
When adbd runs as root, it transitions into the su domain. Add the various rules to support this. This is needed to run the adbd and shell domains in enforcing on userdebug / eng devices without breaking developer workflows. Change-Id: Ib33c0dd2dd6172035230514ac84fcaed2ecf44d6
22 lines
550 B
Text
22 lines
550 B
Text
# File types must be defined for file_contexts.
|
|
type su_exec, exec_type, file_type;
|
|
|
|
userdebug_or_eng(`
|
|
type su, domain;
|
|
domain_auto_trans(shell, su_exec, su)
|
|
|
|
# Allow dumpstate to call su on userdebug / eng builds to collect
|
|
# additional information.
|
|
domain_auto_trans(dumpstate, su_exec, su)
|
|
|
|
# su is unconfined.
|
|
unconfined_domain(su)
|
|
|
|
allow su ashmem_device:chr_file execute;
|
|
allow su self:process execmem;
|
|
tmpfs_domain(su)
|
|
allow su su_tmpfs:file execute;
|
|
|
|
# su is also permissive to permit setenforce.
|
|
permissive su;
|
|
')
|