blob: 8615148259912200bb571ef95f0bb40c4248577e [file] [log] [blame]
Nick Kralevich88ce9512014-01-09 15:25:36 -08001# File types must be defined for file_contexts.
Stephen Smalley01301542013-09-27 10:38:14 -04002type su_exec, exec_type, file_type;
Stephen Smalley2dd4e512012-01-04 12:33:27 -05003
Nick Kralevich88ce9512014-01-09 15:25:36 -08004userdebug_or_eng(`
Stephen Smalleyb3cb9692014-02-21 13:45:29 -05005 # Domain used for su processes, as well as for adbd and adb shell
6 # after performing an adb root command. The domain definition is
7 # wrapped to ensure that it does not exist at all on -user builds.
Nick Kralevich88ce9512014-01-09 15:25:36 -08008 type su, domain;
9 domain_auto_trans(shell, su_exec, su)
Nick Kralevich09e6abd2013-12-13 22:19:45 -080010
Nick Kralevich88ce9512014-01-09 15:25:36 -080011 # Allow dumpstate to call su on userdebug / eng builds to collect
12 # additional information.
13 domain_auto_trans(dumpstate, su_exec, su)
Stephen Smalleyd99e6d52013-12-02 14:18:11 -050014
Nick Kralevich88ce9512014-01-09 15:25:36 -080015 # su is unconfined.
16 unconfined_domain(su)
17
Nick Kralevich7d0f9552014-01-18 18:07:06 -080018 allow su ashmem_device:chr_file execute;
19 allow su self:process execmem;
20 tmpfs_domain(su)
21 allow su su_tmpfs:file execute;
Nick Kralevich116a20f2014-02-05 16:36:25 -080022 allow su debuggerd_prop:property_service set;
Nick Kralevich7d0f9552014-01-18 18:07:06 -080023
Nick Kralevich88ce9512014-01-09 15:25:36 -080024 # su is also permissive to permit setenforce.
25 permissive su;
Sreeram Ramachandranbc320182014-05-02 14:50:26 -070026
27 # Make su a net domain.
28 net_domain(su)
Nick Kralevichaf7deff2014-05-27 15:46:39 -070029
30 dontaudit su self:capability_class_set *;
31 dontaudit su kernel:security *;
32 dontaudit su kernel:system *;
33 dontaudit su self:memprotect *;
34 dontaudit su domain:process *;
35 dontaudit su domain:fd *;
36 dontaudit su domain:dir *;
37 dontaudit su domain:lnk_file *;
38 dontaudit su domain:{ fifo_file file } *;
39 dontaudit su domain:socket_class_set *;
40 dontaudit su domain:ipc_class_set *;
41 dontaudit su domain:key *;
42 dontaudit su fs_type:filesystem *;
43 dontaudit su {fs_type dev_type file_type}:dir_file_class_set *;
44 dontaudit su node_type:node *;
45 dontaudit su node_type:{ tcp_socket udp_socket rawip_socket } *;
46 dontaudit su netif_type:netif *;
47 dontaudit su port_type:socket_class_set *;
48 dontaudit su port_type:{ tcp_socket dccp_socket } *;
49 dontaudit su domain:peer *;
50 dontaudit su domain:binder *;
51 dontaudit su property_type:property_service *;
Nick Kralevich88ce9512014-01-09 15:25:36 -080052')