commit 646202704d869055784ab8561535e85f9d29734e
author William Roberts <william.c.roberts@linux.intel.com> Wed May 13 17:06:37 2015 -0700
committer Nick Kralevich <nnk@google.com> Thu Jun 18 11:52:53 2015 -0700
tree 8ec275940f19ac1662891a472aca6241a38e9df4
parent 7c065a9f138e5e552b087a307d15c870b6a58553

neverallow transitions to shell

Only a few daemons need transition to shell. Prevent
misuse and over-privileging of shell domain.

Signed-off-by: William Roberts <william.c.roberts@linux.intel.com>
(cherry picked from commit d1fa4d3d92c88bde9ecd118c178d0297d0f30f9b)

Bug: 21924438
Change-Id: I013143cc5ab1e95bf3f7388ce51619e0e3b18425

domain.te

diff --git a/domain.te b/domain.te
index 3775c95..9331457 100644
--- a/domain.te
+++ b/domain.te
@@ -443,3 +443,16 @@
 # do not grant anything greater than r_file_perms and relabelfrom unlink
 # to installd
 neverallow installd system_data_file:file ~{ r_file_perms relabelfrom unlink };
+
+#
+# Only these domains should transition to shell domain. This domain is
+# permissible for the "shell user". If you need a process to exec a shell
+# script with differing privilege, define a domain and set up a transition.
+#
+neverallow {
+  domain
+  -adbd
+  -init
+  -runas
+  -zygote
+} shell:process { transition dyntransition };