android_system_sepolicy/runas.te

type runas, domain;
type runas_exec, exec_type, file_type;
unconfined_domain(runas)

# ndk-gdb invokes adb shell run-as.
domain_auto_trans(shell, runas_exec, runas)
Make all domains unconfined. This prevents denials from being generated by the base policy. Over time, these rules will be incrementally tightened to improve security. Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11 2013-05-17 17:11:29 -07:00			`type runas, domain;`
Make sure exec_type is assigned to all entrypoint types. Some file types used as domain entrypoints were missing the exec_type attribute. Add it and add a neverallow rule to keep it that way. Change-Id: I7563f3e03940a27ae40ed4d6bb74181c26148849 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-09-27 07:38:14 -07:00			`type runas_exec, exec_type, file_type;`
Make all domains unconfined. This prevents denials from being generated by the base policy. Over time, these rules will be incrementally tightened to improve security. Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11 2013-05-17 17:11:29 -07:00			`unconfined_domain(runas)`
Add policy for run-as program. Add policy for run-as program and label it in file_contexts. Drop MLS constraints on local socket checks other than create/relabel as this interferes with connections with services, in particular for adb forward. Change-Id: Ib0c4abeb7cbef559e150a620c45a7c31e0531114 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2012-11-13 10:00:05 -08:00
			`# ndk-gdb invokes adb shell run-as.`
			`domain_auto_trans(shell, runas_exec, runas)`