Stephen Smalley | e884872 | 2012-11-13 13:00:05 -0500 | [diff] [blame] | 1 | type shell, domain, mlstrustedsubject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 2 | type shell_exec, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 3 | domain_auto_trans(init, shell_exec, shell) |
| 4 | allow shell rootfs:dir r_dir_perms; |
| 5 | allow shell devpts:chr_file rw_file_perms; |
| 6 | allow shell tty_device:chr_file rw_file_perms; |
| 7 | allow shell console_device:chr_file rw_file_perms; |
| 8 | allow shell system_file:file x_file_perms; |
| 9 | allow shell shell_exec:file rx_file_perms; |
| 10 | allow shell zygote_exec:file rx_file_perms; |
| 11 | allow shell shell_data_file:dir create_dir_perms; |
| 12 | allow shell shell_data_file:file create_file_perms; |
| 13 | allow shell shell_data_file:file rx_file_perms; |
| 14 | |
Stephen Smalley | c83d008 | 2012-03-07 14:59:01 -0500 | [diff] [blame] | 15 | # Access sdcard. |
William Roberts | c195ec3 | 2013-03-06 16:26:36 -0800 | [diff] [blame] | 16 | allow shell sdcard_type:dir rw_dir_perms; |
| 17 | allow shell sdcard_type:file create_file_perms; |
Stephen Smalley | 6261d6d | 2012-01-12 08:57:50 -0500 | [diff] [blame] | 18 | |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 19 | r_dir_file(shell, apk_data_file) |
Geremy Condra | ba84bf1 | 2013-03-22 21:41:37 +0000 | [diff] [blame] | 20 | allow shell dalvikcache_data_file:file write; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 21 | |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 22 | # Run logcat. |
| 23 | allow shell log_device:chr_file r_file_perms; |
| 24 | |
| 25 | # Run app_process. |
| 26 | # XXX Split into its own domain? |
| 27 | app_domain(shell) |
Stephen Smalley | 124720a | 2012-04-04 10:11:16 -0400 | [diff] [blame] | 28 | |
| 29 | # Property Service |
| 30 | allow shell shell_prop:property_service set; |
| 31 | |
| 32 | # setprop toolbox command |
William Roberts | c34a252 | 2012-11-27 08:18:52 -0800 | [diff] [blame] | 33 | unix_socket_connect(shell, property, init) |
Stephen Smalley | 124720a | 2012-04-04 10:11:16 -0400 | [diff] [blame] | 34 | |
| 35 | # ctl interface |
| 36 | allow shell ctl_dumpstate_prop:property_service set; |