Support run-as and ndk-gdb functionality.
Confine run-as (but leave permissive for now) and add
other allow rules required for the use of run-as and ndk-gdb
functionality.
Change-Id: Ifae38233c091cd34013e98830d72aac4c4adcae0
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
diff --git a/adbd.te b/adbd.te
index 84d1c2b..6adba83 100644
--- a/adbd.te
+++ b/adbd.te
@@ -13,3 +13,12 @@
# Allow access in case /data/misc/adb still has the old type.
allow adbd system_data_file:dir search;
allow adbd system_data_file:file r_file_perms;
+
+# ndk-gdb invokes adb forward to forward the gdbserver socket.
+allow adbd app_data_file:dir search;
+allow adbd app_data_file:sock_file write;
+allow adbd appdomain:unix_stream_socket connectto;
+
+# ndk-gdb invokes adb pull of app_process, linker, and libc.so.
+allow adbd zygote_exec:file r_file_perms;
+allow adbd system_file:file r_file_perms;