Restrict the ability to set SELinux enforcing mode to init.
Also make su and shell permissive in non-user builds to allow
use of setenforce without violating the neverallow rule.
Change-Id: Ie76ee04e90d5a76dfaa5f56e9e3eb7e283328a3f
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
diff --git a/shell.te b/shell.te
index 8b51003..032f70f 100644
--- a/shell.te
+++ b/shell.te
@@ -6,3 +6,6 @@
# Run app_process.
# XXX Split into its own domain?
app_domain(shell)
+
+# shell is also permissive to permit setenforce.
+permissive shell;