| # Toolbox installation for vendor binaries / scripts |
| # Non-vendor processes are not allowed to execute the binary |
| # and is always executed without transition. |
| type vendor_toolbox_exec, exec_type, vendor_file_type, file_type; |
| |
| # Do not allow domains to transition to vendor toolbox |
| # or read, execute the vendor_toolbox file. |
| full_treble_only(` |
| # Do not allow non-vendor domains to transition |
| # to vendor toolbox except for the allowlisted domains. |
| neverallow { |
| coredomain |
| -init |
| -modprobe |
| } vendor_toolbox_exec:file { entrypoint execute execute_no_trans }; |
| ') |
