fed8a2a4d9
Require all domain transitions or dyntransitions to be explicitly specified in SELinux policy. healthd: Remove healthd_exec / init_daemon_domain(). Healthd lives on the rootfs and has no unique file type. It should be treated consistent with other similar domains. Change-Id: Ief3c1167379cfb5383073fa33c9a95710a883b29
17 lines
502 B
Text
17 lines
502 B
Text
# Life begins with the kernel.
|
|
type kernel, domain;
|
|
|
|
allow kernel init:process dyntransition;
|
|
|
|
# The kernel is unconfined.
|
|
unconfined_domain(kernel)
|
|
relabelto_domain(kernel)
|
|
|
|
allow kernel {fs_type dev_type file_type}:dir_file_class_set relabelto;
|
|
allow kernel unlabeled:filesystem mount;
|
|
|
|
# Initial setenforce by init prior to switching to init domain.
|
|
allow kernel self:security setenforce;
|
|
|
|
# Set checkreqprot by init.rc prior to switching to init domain.
|
|
allow kernel self:security setcheckreqprot;
|