Add policy for run-as program.

Add policy for run-as program and label it in file_contexts.
Drop MLS constraints on local socket checks other than create/relabel
as this interferes with connections with services, in particular for
adb forward.

Change-Id: Ib0c4abeb7cbef559e150a620c45a7c31e0531114
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

1 files changed, 1 insertions, 1 deletions

diff --git a/shell.te b/shell.te
index 6e5329f..1f370d1 100644
--- a/shell.te
+++ b/shell.te
@@ -1,4 +1,4 @@
-type shell, domain;
+type shell, domain, mlstrustedsubject;
 type shell_exec, file_type;
 domain_auto_trans(init, shell_exec, shell)
 allow shell rootfs:dir r_dir_perms;