commit 59e40a04e2aa5b8e0dff9942cde04704d2ce3524
author Geremy Condra <gcondra@google.com> Mon May 06 22:51:51 2013 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Mon May 06 22:51:51 2013 +0000
tree b2a8e7649ade3197f9be5ba48bf28b1f096e9aae
parent c65b2ba33871da9b241473b6f1a64775c9c49603
parent 8199123c8d1cf971c4edbab26e701df10a8bbc28

Merge "SELinux policy that separates "init_shell" from "shell"." into jb-mr2-dev

init_shell.te

diff --git a/init_shell.te b/init_shell.te
new file mode 100644
index 0000000..a2f6a3c
--- /dev/null
+++ b/init_shell.te
@@ -0,0 +1,14 @@
+# Restricted domain for shell processes spawned by init
+type init_shell, domain, mlstrustedsubject;
+domain_auto_trans(init, shell_exec, init_shell)
+allow init_shell rootfs:dir r_dir_perms;
+allow init_shell devpts:chr_file rw_file_perms;
+allow init_shell tty_device:chr_file rw_file_perms;
+allow init_shell console_device:chr_file rw_file_perms;
+allow init_shell input_device:chr_file rw_file_perms;
+allow init_shell system_file:file x_file_perms;
+allow init_shell shell_exec:file rx_file_perms;
+allow init_shell zygote_exec:file rx_file_perms;
+
+# setprop toolbox command
+unix_socket_connect(init_shell, property, init)

shell.te

diff --git a/shell.te b/shell.te
index acf123b..7870207 100644
--- a/shell.te
+++ b/shell.te
@@ -1,6 +1,6 @@
+# Domain for shell processes spawned by ADB
 type shell, domain, mlstrustedsubject;
 type shell_exec, file_type;
-domain_auto_trans(init, shell_exec, shell)
 allow shell rootfs:dir r_dir_perms;
 allow shell devpts:chr_file rw_file_perms;
 allow shell tty_device:chr_file rw_file_perms;