adb: add SELinux policy for adbd and interactive adb shell session by jaihindy · Pull Request #1176 · SELinuxProject/refpolicy

jaihindy · 2026-07-08T09:41:14Z

This patch introduces SELinux policy support for adbd and interactive
adb shell sessions.

It defines the adbd_t and adb_shell_t domains, establishes the
transition between them, and provides the permissions required for
interactive shell operation.

The module also introduces the adb_unconfined_shell tunables,
allowing interactive adb shell sessions to transition to
the unconfined_t domains instead of the default adb_shell_t domain
when enabled.

Additional debugging-related permissions are isolated behind the
adb_shell_extended_access tunable, which remains disabled by default
to preserve the default security posture while allowing developers to
enable extended debugging capabilities when needed.

pebenito

How much testing has this received? For example, adb can operate over IP, but I see nothing about that in adbd_t. What about adb operations other than the shell?

There should probably also be tunables controlling which domain you end up in for the shell. It seems like we should be able to toggle between unconfined (if available), sysadm, and the restricted adb_shell_t.

Please rename the module to simply "adb".

Please refer to StyleGuide as this needs style cleanup.

pebenito · 2026-07-09T17:39:13Z

@@ -0,0 +1,111 @@
+policy_module(adb_shell, 1.0)


The version field is deprecated.

thesamesam · 2026-07-09T17:56:30Z

+files_read_var_symlinks(adb_shell_t)
+files_read_mnt_symlinks(adb_shell_t)
+
+dbus_system_bus_client(adb_shell_t)


Is dbus mandatory for adb? If not, this should be an optional_policy.

jaihindy · 2026-07-16T10:52:20Z

How much testing has this received? For example, adb can operate over IP, but I see nothing about that in adbd_t. What about adb operations other than the shell?

There should probably also be tunables controlling which domain you end up in for the shell. It seems like we should be able to toggle between unconfined (if available), sysadm, and the restricted adb_shell_t.

Please rename the module to simply "adb".

Please refer to StyleGuide as this needs style cleanup.

Thanks for the review and suggestions.

I have renamed the module from adb_shell to adb and started cleaning up the policy according to the refpolicy StyleGuide.

For testing, the current testing has mainly covered adbd startup and interactive adb shell over the local/USB path. I will expand the test coverage and document the results in the PR description, including:

adbd daemon startup and domain transition
adb shell
adb shell dmesg
adb shell mount
adb push / adb pull
adb shell (interactive)
adb shell
I am running more adb/adb shell testcases and add sepolicy rules for them.

Regarding the shell domain tunables, I attempted to model this as tunable-controlled transitions from adbd_t to adb_shell_t, sysadm_t, and unconfined_t using shell_exec_t as the entrypoint. However, this results in conflicting type_transition rules for the same tuple as below.
| Conflicting type rules (scontext=adbd_t tcontext=shell_exec_t tclass=process result=unconfined_t), existing=adb_shell_t
| Expanded from type rule (scontext=adbd_t tcontext=shell_exec_t tclass=process result=unconfined_t)
| Failed to insert typerule into avtab at /refpolicy-targeted/2.20260312+git/image/etc/selinux/targeted/tmp/modules/100/adb/cil:245
| Failure while walking true conditional block at /refpolicy-targeted/2.20260312+git/image/etc/selinux/targeted/tmp/modules/100/adb/cil:241
| Binary policy creation failed at /refpolicy-targeted/2.20260312+git/image/etc/selinux/targeted/tmp/modules/100/adb/cil:240
| Failed to generate binary
| semodule: Failed!
For example, selecting between adb_shell_t and unconfined_t through conditionals still causes semodule/libsepol to reject the policy because multiple transition results exist for the same source/entrypoint/class.
please let me know if i am missing here something?

Can you please help to review the change.

pebenito · 2026-07-20T17:38:35Z

Regarding the shell domain tunables, I attempted to model this as tunable-controlled transitions from adbd_t to adb_shell_t, sysadm_t, and unconfined_t using shell_exec_t as the entrypoint.

You need to make sure the transitions are in opposite if-then-else blocks, e.g.:

if (adb_sysadm_shell) {
sysadm_domtrans(...)
} else {
corecmd_shell_domtrans(...)
}

jaihindy · 2026-07-21T10:53:12Z

Regarding the shell domain tunables, I attempted to model this as tunable-controlled transitions from adbd_t to adb_shell_t, sysadm_t, and unconfined_t using shell_exec_t as the entrypoint.

You need to make sure the transitions are in opposite if-then-else blocks, e.g.:
if (adb_sysadm_shell) {
sysadm_domtrans(...)
} else {
corecmd_shell_domtrans(...)
}

thanks for the suggestion and I have updated the change .
could you please review the change.

pebenito

Theres still style issues.

pebenito · 2026-07-21T13:52:27Z

+
+allow adb_shell_t self:fifo_file rw_inherited_fifo_file_perms;
+allow adb_shell_t self:process { setpgid getcap signal };
+allow adb_shell_t self:capability { net_admin sys_resource };


Why are these capabilities needed by default? There should be transitions to other domains for tools that need them.

thanks , removed these capabilities.
can you please review it again.

Add SELinux policy support for the Android Debug Bridge (ADB) daemon and interactive adb shell sessions. The new module introduces the adbd_t and adb_shell_t domains and defines the transition from adbd_t to adb_shell_t when launching an interactive shell. The module also introduces the adb_unconfined_shell tunables, allowing interactive adb shell sessions to transition to the unconfined_t domains instead of the default adb_shell_t domain when enabled. The policy allows the operations required by adbd, including shell access, PTY allocation, temporary file management, log access, runtime configuration lookup, USB transport support, and file transfer operations used by adb push and adb pull. An optional adb_shell_extended_access tunable is provided for debugging and diagnostic use cases. When enabled, it grants access to selected kernel state information, sysctls, SELinux policy information, kernel logs, and other resources commonly used during troubleshooting. Signed-off-by: Jaihind Yadav <jaihindy@qti.qualcomm.com>

jaihindy force-pushed the adb_shell_sepolicy branch 2 times, most recently from c55ae13 to 8de93b6 Compare July 9, 2026 17:16

pebenito requested changes Jul 9, 2026

View reviewed changes

thesamesam reviewed Jul 9, 2026

View reviewed changes

jaihindy force-pushed the adb_shell_sepolicy branch from 8de93b6 to e128d7f Compare July 16, 2026 12:26

jaihindy requested review from pebenito and thesamesam July 16, 2026 12:27

jaihindy force-pushed the adb_shell_sepolicy branch from e128d7f to e10a4dd Compare July 21, 2026 10:51

jaihindy force-pushed the adb_shell_sepolicy branch from e10a4dd to d444c1f Compare July 21, 2026 10:56

pebenito requested changes Jul 21, 2026

View reviewed changes

jaihindy force-pushed the adb_shell_sepolicy branch 2 times, most recently from 05048b9 to 50a904a Compare July 22, 2026 18:37

jaihindy requested a review from pebenito July 22, 2026 18:45

jaihindy force-pushed the adb_shell_sepolicy branch from 50a904a to a1a878c Compare July 23, 2026 05:38

pebenito approved these changes Jul 23, 2026

View reviewed changes

pebenito changed the title ~~adb_shell: add SELinux policy for adbd and interactive adb shell session~~ adb: add SELinux policy for adbd and interactive adb shell session Jul 23, 2026

pebenito merged commit 6beab6b into SELinuxProject:main Jul 23, 2026
119 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

adb: add SELinux policy for adbd and interactive adb shell session - #1176

adb: add SELinux policy for adbd and interactive adb shell session#1176
pebenito merged 1 commit into
SELinuxProject:mainfrom
jaihindy:adb_shell_sepolicy

jaihindy commented Jul 8, 2026 •

edited

Loading

Uh oh!

pebenito left a comment

Uh oh!

pebenito Jul 9, 2026

Uh oh!

thesamesam Jul 9, 2026

Uh oh!

jaihindy Jul 20, 2026

Uh oh!

jaihindy commented Jul 16, 2026

Uh oh!

pebenito commented Jul 20, 2026

Uh oh!

jaihindy commented Jul 21, 2026

Uh oh!

pebenito left a comment

Uh oh!

pebenito Jul 21, 2026

Uh oh!

jaihindy Jul 22, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

jaihindy commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pebenito left a comment

Choose a reason for hiding this comment

Uh oh!

pebenito Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

thesamesam Jul 9, 2026

Choose a reason for hiding this comment

Uh oh!

jaihindy Jul 20, 2026

Choose a reason for hiding this comment

Uh oh!

jaihindy commented Jul 16, 2026

Uh oh!

pebenito commented Jul 20, 2026

Uh oh!

jaihindy commented Jul 21, 2026

Uh oh!

pebenito left a comment

Choose a reason for hiding this comment

Uh oh!

pebenito Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

jaihindy Jul 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jaihindy commented Jul 8, 2026 •

edited

Loading