1 # Domain for shell processes spawned by ADB or console service. 2 type shell, domain, mlstrustedsubject; 3 type shell_exec, exec_type, file_type; 4 5 # Create and use network sockets. 6 net_domain(shell) 7 8 # Run app_process. 9 # XXX Transition into its own domain? 10 app_domain(shell) 11 12 # logd access 13 read_logd(shell) 14 control_logd(shell) 15 16 # read files in /data/anr 17 allow shell anr_data_file:dir r_dir_perms; 18 allow shell anr_data_file:file r_file_perms; 19 20 # Access /data/local/tmp. 21 allow shell shell_data_file:dir create_dir_perms; 22 allow shell shell_data_file:file create_file_perms; 23 allow shell shell_data_file:file rx_file_perms; 24 25 # adb bugreport 26 unix_socket_connect(shell, dumpstate, dumpstate) 27 28 allow shell devpts:chr_file rw_file_perms; 29 allow shell tty_device:chr_file rw_file_perms; 30 allow shell console_device:chr_file rw_file_perms; 31 allow shell input_device:dir r_dir_perms; 32 allow shell input_device:chr_file rw_file_perms; 33 allow shell system_file:file x_file_perms; 34 allow shell shell_exec:file rx_file_perms; 35 allow shell zygote_exec:file rx_file_perms; 36 37 r_dir_file(shell, apk_data_file) 38 39 # Set properties. 40 unix_socket_connect(shell, property, init) 41 allow shell shell_prop:property_service set; 42 allow shell ctl_dumpstate_prop:property_service set; 43 allow shell debug_prop:property_service set; 44 allow shell powerctl_prop:property_service set; 45 46 # systrace support - allow atrace to run 47 # debugfs doesn't support labeling individual files, so we have 48 # to grant read access to all of /sys/kernel/debug. 49 # Directory read access and file write access is already granted 50 # in domain.te. 51 allow shell debugfs:file r_file_perms; 52 53 # allow shell to run dmesg 54 allow shell kernel:system syslog_read; 55
