| type shell, domain, mlstrustedsubject; |
| type shell_exec, file_type; |
| domain_auto_trans(init, shell_exec, shell) |
| allow shell rootfs:dir r_dir_perms; |
| allow shell devpts:chr_file rw_file_perms; |
| allow shell tty_device:chr_file rw_file_perms; |
| allow shell console_device:chr_file rw_file_perms; |
| allow shell system_file:file x_file_perms; |
| allow shell shell_exec:file rx_file_perms; |
| allow shell zygote_exec:file rx_file_perms; |
| allow shell shell_data_file:dir create_dir_perms; |
| allow shell shell_data_file:file create_file_perms; |
| allow shell shell_data_file:file rx_file_perms; |
| |
| # Access sdcard. |
| allow shell sdcard:dir rw_dir_perms; |
| allow shell sdcard:file create_file_perms; |
| |
| r_dir_file(shell, apk_data_file) |
| allow shell dalvikcache_data_file:file write; |
| |
| # Run dmesg. |
| allow shell kernel:system syslog_read; |
| |
| # Run cat /proc/kmsg. |
| allow shell kernel:system syslog_mod; |
| |
| # Run logcat. |
| allow shell log_device:chr_file r_file_perms; |
| |
| # Run app_process. |
| # XXX Split into its own domain? |
| app_domain(shell) |
| |
| # Property Service |
| allow shell shell_prop:property_service set; |
| |
| # setprop toolbox command |
| unix_socket_connect(shell, property, init) |
| |
| # ctl interface |
| allow shell ctl_dumpstate_prop:property_service set; |
