| Stephen Smalley | 712ca0a | 2013-10-23 13:25:53 -0400 | [diff] [blame] | 1 | # Rules for all shell domains (e.g. console service and adb shell). |
| 2 | |
| 3 | # Access /data/local/tmp. |
| 4 | allow shelldomain shell_data_file:dir create_dir_perms; |
| 5 | allow shelldomain shell_data_file:file create_file_perms; |
| 6 | allow shelldomain shell_data_file:file rx_file_perms; |
| 7 | |
| Stephen Smalley | 712ca0a | 2013-10-23 13:25:53 -0400 | [diff] [blame] | 8 | # adb bugreport |
| 9 | unix_socket_connect(shelldomain, dumpstate, dumpstate) |
| 10 | |
| 11 | allow shelldomain rootfs:dir r_dir_perms; |
| 12 | allow shelldomain devpts:chr_file rw_file_perms; |
| 13 | allow shelldomain tty_device:chr_file rw_file_perms; |
| 14 | allow shelldomain console_device:chr_file rw_file_perms; |
| 15 | allow shelldomain input_device:chr_file rw_file_perms; |
| 16 | allow shelldomain system_file:file x_file_perms; |
| 17 | allow shelldomain shell_exec:file rx_file_perms; |
| 18 | allow shelldomain zygote_exec:file rx_file_perms; |
| 19 | |
| 20 | r_dir_file(shelldomain, apk_data_file) |
| Stephen Smalley | 712ca0a | 2013-10-23 13:25:53 -0400 | [diff] [blame] | 21 | |
| 22 | # Set properties. |
| 23 | unix_socket_connect(shelldomain, property, init) |
| 24 | allow shelldomain shell_prop:property_service set; |
| 25 | allow shelldomain ctl_dumpstate_prop:property_service set; |
| Nick Kralevich | 20a791a | 2013-12-19 21:55:12 -0800 | [diff] [blame] | 26 | allow shelldomain debug_prop:property_service set; |
| 27 | allow shelldomain powerctl_prop:property_service set; |
| Nick Kralevich | 0e06c13 | 2014-04-30 11:35:02 -0700 | [diff] [blame] | 28 | |
| 29 | # systrace support - allow atrace to run |
| 30 | # debugfs doesn't support labeling individual files, so we have |
| 31 | # to grant read access to all of /sys/kernel/debug. |
| 32 | # Directory read access and file write access is already granted |
| 33 | # in domain.te. |
| 34 | allow shelldomain debugfs:file r_file_perms; |
| Nick Kralevich | f821b5a | 2014-05-27 16:49:59 -0700 | [diff] [blame] | 35 | |
| 36 | # allow shell to run dmesg |
| 37 | allow shelldomain kernel:system syslog_read; |