Restrict the ability to set SELinux enforcing mode to init.

Also make su and shell permissive in non-user builds to allow
use of setenforce without violating the neverallow rule.

Change-Id: Ie76ee04e90d5a76dfaa5f56e9e3eb7e283328a3f
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

1 files changed, 3 insertions, 0 deletions

diff --git a/shell.te b/shell.te
index 8b51003..032f70f 100644
--- a/shell.te
+++ b/shell.te
@@ -6,3 +6,6 @@ unconfined_domain(shell)
 # Run app_process.
 # XXX Split into its own domain?
 app_domain(shell)
+
+# shell is also permissive to permit setenforce.
+permissive shell;