adb_shell: add SELinux policy for adbd and interactive adb shell session

Add SELinux policy support for adbd and interactive adb shell
sessions.

The new module defines the adbd_t and adb_shell_t domains and the
domain transition from adbd_t to adb_shell_t when launching an
interactive shell.

The policy grants the permissions required for PTY allocation,
shell execution, temporary file handling, runtime configuration
access, filesystem traversal, and interaction with common system
resources needed during adb shell startup.

Additional debugging and diagnostic capabilities are provided
through the adb_shell_extended_access tunable, which is disabled
by default. When enabled, it grants access to selected kernel
state information, sysctls, SELinux policy information, kernel
logs, and other resources useful for troubleshooting.

This allows interactive adb shell functionality while keeping
additional debugging permissions optional.

Signed-off-by: Jaihind Yadav <jaihindy@qti.qualcomm.com>

Author: jaihindy

policy/modules/services/adb_shell.fc

@@ -0,0 +1 @@
+/usr/bin/adbd    --    gen_context(system_u:object_r:adbd_exec_t,s0)

policy/modules/services/adb_shell.if

@@ -0,0 +1 @@
+## <summary>Policy for adb shell</summary>

policy/modules/services/adb_shell.te

@@ -0,0 +1,111 @@
+policy_module(adb_shell, 1.0)
+
+########################################
+#
+# Declarations
+#
+
+## <desc>
+## <p>
+## Allow extended adb shell functionality for debugging and interactive shell access.
+## </p>
+## </desc>
+gen_tunable(adb_shell_extended_access, false)
+
+type adb_shell_t;
+type adbd_exec_t;
+type adbd_t;
+domain_type(adbd_t)
+domain_type(adb_shell_t)
+
+# ========================================
+# Transition: adbd → shell → adb_shell
+# ========================================
+
+init_daemon_domain(adbd_t, adbd_exec_t)
+corecmd_shell_domtrans(adbd_t,adb_shell_t)
+#domain_auto_transition_pattern(adbd_t, shell_exec_t, adb_shell_t)
+role system_r types adb_shell_t;
+
+# ========================================
+# # adbd_t Local Policy
+#
+
+corecmd_search_bin(adbd_t)
+term_use_generic_ptys(adbd_t)
+term_use_ptmx(adbd_t)
+files_read_etc_files(adbd_t)
+allow adbd_t self:capability sys_resource;
+dev_rw_usbfs(adbd_t)
+
+# ========================================
+# adb_shell_t Local Policy
+#
+corecmd_shell_entry_type(adb_shell_t)
+corecmd_exec_bin(adb_shell_t)
+allow adb_shell_t self:fifo_file read;
+allow adb_shell_t self:process setpgid;
+allow adb_shell_t adbd_t:fd use;
+
+term_use_ptmx(adb_shell_t)
+term_use_generic_ptys(adb_shell_t)
+
+files_read_etc_files(adb_shell_t)
+
+files_search_var(adb_shell_t)
+logging_search_logs(adb_shell_t)
+logging_list_logs(adb_shell_t)
+
+fs_getattr_xattr_fs(adb_shell_t)
+
+files_search_var(adb_shell_t)
+files_search_tmp(adb_shell_t)
+files_search_spool(adb_shell_t)
+
+dev_search_sysfs(adb_shell_t)
+
+kernel_search_proc(adb_shell_t)
+
+userdom_search_user_home_dirs(adb_shell_t)
+
+files_read_usr_symlinks(adb_shell_t)
+files_getattr_var_lib_dirs(adb_shell_t)
+seutil_read_config(adb_shell_t)
+files_read_mnt_files(adb_shell_t)
+files_search_default(adb_shell_t)
+fs_list_auto_mountpoints(adb_shell_t)
+files_read_var_symlinks(adb_shell_t)
+files_read_mnt_symlinks(adb_shell_t)
+
+dbus_system_bus_client(adb_shell_t)
+
+optional_policy(`
+    dnsmasq_domtrans(adb_shell_t)
+')
+
+
+tunable_policy(`adb_shell_extended_access',`
+
+    kernel_read_vm_sysctls(adb_shell_t)
+    kernel_read_fs_sysctls(adb_shell_t)
+
+    dev_read_kmsg(adb_shell_t)
+
+    selinux_read_policy(adb_shell_t)
+
+    mount_exec(adb_shell_t)
+
+    dmesg_exec(adb_shell_t)
+    kernel_read_ring_buffer(adb_shell_t)
+
+    files_read_etc_runtime_files(adb_shell_t)
+    files_read_usr_symlinks(adb_shell_t)
+
+    files_manage_var_dirs(adb_shell_t)
+    files_manage_var_files(adb_shell_t)
+
+    selinux_get_fs_mount(adb_shell_t)
+
+    userdom_use_user_terminals(adb_shell_t)
+
+')