system_sepolicy.patch

diff --git a/app.te b/app.te
index e9dd7b3..dc511cd 100644
--- a/app.te
+++ b/app.te
@@ -274,14 +274,14 @@ allow appdomain cache_file:dir getattr;
 
 # Superuser capabilities.
 # bluetooth requires net_admin and wake_alarm.
-neverallow { appdomain -bluetooth } self:capability *;
-neverallow { appdomain -bluetooth } self:capability2 *;
+neverallow { appdomain -su -bluetooth } self:capability *;
+neverallow { appdomain -su -bluetooth } self:capability2 *;
 
 # Block device access.
-neverallow appdomain dev_type:blk_file { read write };
+neverallow { appdomain -su } dev_type:blk_file { read write };
 
 # Access to any of the following character devices.
-neverallow appdomain {
+neverallow { appdomain -su } {
     audio_device
     camera_device
     dm_device
@@ -294,14 +294,14 @@ neverallow appdomain {
 # Note: Try expanding list of app domains in the future.
 neverallow { untrusted_app isolated_app shell } graphics_device:chr_file { read write };
 
-neverallow { appdomain -nfc } nfc_device:chr_file
+neverallow { appdomain -nfc -su } nfc_device:chr_file
     { read write };
-neverallow { appdomain -bluetooth } hci_attach_dev:chr_file
+neverallow { appdomain -bluetooth -su } hci_attach_dev:chr_file
     { read write };
-neverallow appdomain tee_device:chr_file { read write };
+neverallow { appdomain -su } tee_device:chr_file { read write };
 
 # Privileged netlink socket interfaces.
-neverallow appdomain
+neverallow { appdomain -su }
     domain:{
         netlink_firewall_socket
         netlink_tcpdiag_socket
@@ -315,29 +315,29 @@ neverallow appdomain
 # These messages are broadcast messages from the kernel to userspace.
 # Do not allow the writing of netlink messages, which has been a source
 # of rooting vulns in the past.
-neverallow appdomain domain:netlink_kobject_uevent_socket { write append };
+neverallow { appdomain -su } domain:netlink_kobject_uevent_socket { write append };
 
 # Sockets under /dev/socket that are not specifically typed.
-neverallow appdomain socket_device:sock_file write;
+neverallow { appdomain -su } socket_device:sock_file write;
 
 # Unix domain sockets.
-neverallow appdomain adbd_socket:sock_file write;
-neverallow appdomain installd_socket:sock_file write;
-neverallow { appdomain -radio } rild_socket:sock_file write;
-neverallow appdomain vold_socket:sock_file write;
-neverallow appdomain zygote_socket:sock_file write;
+neverallow { appdomain -su } adbd_socket:sock_file write;
+neverallow { appdomain -su } installd_socket:sock_file write;
+neverallow { appdomain -su -radio } rild_socket:sock_file write;
+neverallow { appdomain -su } vold_socket:sock_file write;
+neverallow { appdomain -su } zygote_socket:sock_file write;
 
 # ptrace access to non-app domains.
-neverallow appdomain { domain -appdomain }:process ptrace;
+neverallow { appdomain -su } { domain -appdomain }:process ptrace;
 
 # Write access to /proc/pid entries for any non-app domain.
-neverallow appdomain { domain -appdomain }:file write;
+neverallow { appdomain -su } { domain -appdomain }:file write;
 
 # signal access to non-app domains.
 # sigchld allowed for parent death notification.
 # signull allowed for kill(pid, 0) existence test.
 # All others prohibited.
-neverallow appdomain { domain -appdomain }:process
+neverallow { appdomain -su } { domain -appdomain }:process
     { sigkill sigstop signal };
 
 # Transition to a non-app domain.
@@ -347,87 +347,87 @@ neverallow { appdomain -shell userdebug_or_eng(`-su') } { domain -appdomain }:pr
     { transition dyntransition };
 
 # Write to rootfs.
-neverallow appdomain rootfs:dir_file_class_set
+neverallow { appdomain -su } rootfs:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
 
 # Write to /system.
-neverallow appdomain system_file:dir_file_class_set
+neverallow { appdomain -su } system_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
 
 # Write to entrypoint executables.
-neverallow appdomain exec_type:file
+neverallow { appdomain -su } exec_type:file
     { create write setattr relabelfrom relabelto append unlink link rename };
 
 # Write to system-owned parts of /data.
 # This is the default type for anything under /data not otherwise
 # specified in file_contexts.  Define a different type for portions
 # that should be writable by apps.
-neverallow appdomain system_data_file:dir_file_class_set
+neverallow { appdomain -su } system_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
 
 # Write to various other parts of /data.
-neverallow appdomain drm_data_file:dir_file_class_set
+neverallow { appdomain -su } drm_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
-neverallow { appdomain -system_app }
+neverallow { appdomain -system_app -su }
     gps_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
-neverallow { appdomain -platform_app }
+neverallow { appdomain -platform_app -su }
     apk_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
-neverallow { appdomain -platform_app }
+neverallow { appdomain -platform_app -su }
     apk_tmp_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
-neverallow { appdomain -platform_app }
+neverallow { appdomain -platform_app -su }
     apk_private_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
-neverallow { appdomain -platform_app }
+neverallow { appdomain -platform_app -su }
     apk_private_tmp_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
-neverallow { appdomain -shell }
+neverallow { appdomain -shell -su }
     shell_data_file:dir_file_class_set
     { create setattr relabelfrom relabelto append unlink link rename };
-neverallow { appdomain -bluetooth }
+neverallow { appdomain -bluetooth -su }
     bluetooth_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
-neverallow appdomain
+neverallow { appdomain -su }
     keystore_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
-neverallow appdomain
+neverallow { appdomain -su }
     systemkeys_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
-neverallow appdomain
+neverallow { appdomain -su }
     wifi_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
-neverallow appdomain
+neverallow { appdomain -su }
     dhcp_data_file:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
 
 # access tmp apk files
-neverallow { appdomain -platform_app -priv_app }
+neverallow { appdomain -platform_app -priv_app -su }
     { apk_tmp_file apk_private_tmp_file }:dir_file_class_set *;
 
 # Access to factory files.
-neverallow appdomain efs_file:dir_file_class_set write;
-neverallow { appdomain -shell } efs_file:dir_file_class_set read;
+neverallow { appdomain -su } efs_file:dir_file_class_set write;
+neverallow { appdomain -shell -su } efs_file:dir_file_class_set read;
 
 # Write to various pseudo file systems.
-neverallow { appdomain -bluetooth -nfc }
+neverallow { appdomain -bluetooth -nfc -su }
     sysfs:dir_file_class_set write;
-neverallow appdomain
+neverallow { appdomain -su }
     proc:dir_file_class_set write;
 
 # Access to syslog(2) or /proc/kmsg.
-neverallow { appdomain -system_app }
+neverallow { appdomain -system_app -su }
     kernel:system { syslog_mod syslog_console };
-neverallow { appdomain -system_app -shell }
+neverallow { appdomain -system_app -shell -su }
     kernel:system syslog_read;
 
 # Ability to perform any filesystem operation other than statfs(2).
 # i.e. no mount(2), unmount(2), etc.
-neverallow appdomain fs_type:filesystem ~getattr;
+neverallow { appdomain -su } fs_type:filesystem ~getattr;
 
 # prevent creation/manipulation of globally readable symlinks
-neverallow appdomain {
+neverallow { appdomain -su } {
   apk_data_file
   cache_file
   cache_recovery_file
@@ -454,5 +454,5 @@ neverallow {
 }:file no_x_file_perms;
 
 # Foreign dex profiles are just markers. Prevent apps to do anything but touch them.
-neverallow appdomain user_profile_foreign_dex_data_file:file rw_file_perms;
-neverallow appdomain user_profile_foreign_dex_data_file:dir { open getattr read ioctl remove_name };
+neverallow { appdomain -su } user_profile_foreign_dex_data_file:file rw_file_perms;
+neverallow { appdomain -su } user_profile_foreign_dex_data_file:dir { open getattr read ioctl remove_name };
diff --git a/blkid.te b/blkid.te
index 43bc944..df791e8 100644
--- a/blkid.te
+++ b/blkid.te
@@ -15,6 +15,6 @@ allow blkid vold:fifo_file { read write getattr };
 allow blkid blkid_exec:file rx_file_perms;
 
 # Only allow entry from vold
-neverallow { domain -vold } blkid:process transition;
-neverallow * blkid:process dyntransition;
+neverallow { domain -vold -su } blkid:process transition;
+neverallow { domain -su } blkid:process dyntransition;
 neverallow blkid { file_type fs_type -blkid_exec -shell_exec }:file entrypoint;
diff --git a/blkid_untrusted.te b/blkid_untrusted.te
index da3bdac..7b6e5af 100644
--- a/blkid_untrusted.te
+++ b/blkid_untrusted.te
@@ -31,6 +31,6 @@ neverallow blkid_untrusted {
 }:blk_file no_rw_file_perms;
 
 # Only allow entry from vold via blkid binary
-neverallow { domain -vold } blkid_untrusted:process transition;
-neverallow * blkid_untrusted:process dyntransition;
+neverallow { domain -vold -su } blkid_untrusted:process transition;
+neverallow { domain -su } blkid_untrusted:process dyntransition;
 neverallow blkid_untrusted { file_type fs_type -blkid_exec -shell_exec }:file entrypoint;
diff --git a/device.te b/device.te
index 06006b2..acef6e3 100644
--- a/device.te
+++ b/device.te
@@ -35,6 +35,7 @@ type random_device, dev_type, mlstrustedobject;
 type sensors_device, dev_type;
 type serial_device, dev_type;
 type socket_device, dev_type;
+type su_device, dev_type, mlstrustedobject;
 type owntty_device, dev_type, mlstrustedobject;
 type tty_device, dev_type;
 type urandom_device, dev_type, mlstrustedobject;
@@ -47,7 +48,7 @@ type ion_device, dev_type, mlstrustedobject;
 type gps_device, dev_type;
 type qtaguid_device, dev_type;
 type watchdog_device, dev_type;
-type uhid_device, dev_type;
+type uhid_device, dev_type, mlstrustedobject;
 type uio_device, dev_type;
 type tun_device, dev_type, mlstrustedobject;
 type usbaccessory_device, dev_type, mlstrustedobject;
diff --git a/domain.te b/domain.te
index 45569de..588fae0 100644
--- a/domain.te
+++ b/domain.te
@@ -148,12 +148,13 @@ allow domain fs_type:dir getattr;
 ###
 
 # Do not allow any domain other than init or recovery to create unlabeled files.
-neverallow { domain -init -recovery } unlabeled:dir_file_class_set create;
+neverallow { domain -su -init -recovery } unlabeled:dir_file_class_set create;
 
 # Limit ability to ptrace or read sensitive /proc/pid files of processes
 # with other UIDs to these whitelisted domains.
 neverallow {
   domain
+  -su
   -debuggerd
   -vold
   -dumpstate
@@ -164,6 +165,7 @@ neverallow {
 # Limit device node creation to these whitelisted domains.
 neverallow {
   domain
+  -su
   -kernel
   -init
   -ueventd
@@ -181,39 +183,40 @@ neverallow {
   -healthd
   -uncrypt
   -tee
+  -su
 } self:capability sys_rawio;
 
 # No process can map low memory (< CONFIG_LSM_MMAP_MIN_ADDR).
-neverallow * self:memprotect mmap_zero;
+neverallow { domain -su } self:memprotect mmap_zero;
 
 # No domain needs mac_override as it is unused by SELinux.
-neverallow * self:capability2 mac_override;
+neverallow { domain -su } self:capability2 mac_override;
 
 # Only recovery needs mac_admin to set contexts not defined in current policy.
-neverallow { domain -recovery } self:capability2 mac_admin;
+neverallow { domain -recovery -su } self:capability2 mac_admin;
 
 # Only init should be able to load SELinux policies.
 # The first load technically occurs while still in the kernel domain,
 # but this does not trigger a denial since there is no policy yet.
 # Policy reload requires allowing this to the init domain.
-neverallow { domain -init } kernel:security load_policy;
+neverallow { domain -init -su } kernel:security load_policy;
 
 # Only init and the system_server can set selinux.reload_policy 1
 # to trigger a policy reload.
-neverallow { domain -init -system_server } security_prop:property_service set;
+neverallow { domain -init -system_server -su } security_prop:property_service set;
 
 # Only init and system_server can write to /data/security, where runtime
 # policy updates live.
 # Only init can relabel /data/security (for init.rc restorecon_recursive /data).
-neverallow { domain -init } security_file:{ dir file lnk_file } { relabelfrom relabelto };
+neverallow { domain -init -su } security_file:{ dir file lnk_file } { relabelfrom relabelto };
 # Only init and system_server can create/setattr directories with this type.
 # init is for init.rc mkdir /data/security.
 # system_server is for creating subdirectories under /data/security.
-neverallow { domain -init -system_server } security_file:dir { create setattr };
+neverallow { domain -init -system_server -su } security_file:dir { create setattr };
 # Only system_server can create subdirectories and files under /data/security.
-neverallow { domain -system_server } security_file:dir { rename write add_name remove_name rmdir };
-neverallow { domain -system_server } security_file:file { create setattr write append unlink link rename };
-neverallow { domain -system_server } security_file:lnk_file { create setattr unlink rename };
+neverallow { domain -system_server -su } security_file:dir { rename write add_name remove_name rmdir };
+neverallow { domain -system_server -su } security_file:file { create setattr write append unlink link rename };
+neverallow { domain -system_server -su } security_file:lnk_file { create setattr unlink rename };
 
 # Only init prior to switching context should be able to set enforcing mode.
 # init starts in kernel domain and switches to init domain via setcon in
@@ -231,41 +234,41 @@ neverallow * kernel:security setbool;
 neverallow { domain -init } kernel:security setsecparam;
 
 # Only init, ueventd and system_server should be able to access HW RNG
-neverallow { domain -init -system_server -ueventd } hw_random_device:chr_file *;
+neverallow { domain -init -system_server -ueventd -su } hw_random_device:chr_file *;
 
 # Ensure that all entrypoint executables are in exec_type or postinstall_file.
-neverallow * { file_type -exec_type -postinstall_file }:file entrypoint;
+neverallow { domain -su } { file_type -exec_type -postinstall_file }:file entrypoint;
 
 # Ensure that nothing in userspace can access /dev/mem or /dev/kmem
-neverallow { domain -kernel -ueventd -init } kmem_device:chr_file *;
-neverallow * kmem_device:chr_file ~{ create relabelto unlink setattr };
+neverallow { domain -kernel -ueventd -init -su } kmem_device:chr_file *;
+neverallow { domain -su } kmem_device:chr_file ~{ create relabelto unlink setattr };
 
 # Only init should be able to configure kernel usermodehelpers or
 # security-sensitive proc settings.
-neverallow { domain -init } usermodehelper:file { append write };
-neverallow { domain -init } proc_security:file { append write };
+neverallow { domain -init -su } usermodehelper:file { append write };
+neverallow { domain -init -su } proc_security:file { append write };
 
 # No domain should be allowed to ptrace init.
-neverallow * init:process ptrace;
+neverallow { domain -su } init:process ptrace;
 
 # Init can't do anything with binder calls. If this neverallow rule is being
 # triggered, it's probably due to a service with no SELinux domain.
-neverallow * init:binder *;
+neverallow { domain -su } init:binder *;
 
 # Don't allow raw read/write/open access to block_device
 # Rather force a relabel to a more specific type
-neverallow { domain -kernel -init -recovery -uncrypt } block_device:blk_file { open read write };
+neverallow { domain -kernel -init -recovery -uncrypt -su } block_device:blk_file { open read write };
 
 # Don't allow raw read/write/open access to generic devices.
 # Rather force a relabel to a more specific type.
 # init is exempt from this as there are character devices that only it uses.
 # ueventd is exempt from this, as it is managing these devices.
-neverallow { domain -init -ueventd } device:chr_file { open read write };
+neverallow { domain -init -ueventd -su } device:chr_file { open read write };
 
 # Limit what domains can mount filesystems or change their mount flags.
 # sdcard_type / vfat is exempt as a larger set of domains need
 # this capability, including device-specific domains.
-neverallow { domain -kernel -init -recovery -vold -zygote -update_engine -otapreopt_chroot } { fs_type -sdcard_type }:filesystem { mount remount relabelfrom relabelto };
+neverallow { domain -kernel -init -recovery -vold -zygote -update_engine -otapreopt_chroot -su } { fs_type -sdcard_type }:filesystem { mount remount relabelfrom relabelto };
 
 #
 # Assert that, to the extent possible, we're not loading executable content from
@@ -285,14 +288,16 @@ neverallow {
     domain
     -appdomain # for oemfs
     -recovery # for /tmp/update_binary in tmpfs
+    -su
 } { fs_type -rootfs }:file execute;
 # Files from cache should never be executed
-neverallow domain { cache_file cache_backup_file cache_private_backup_file cache_recovery_file }:file execute;
+neverallow { domain -su } { cache_file cache_backup_file cache_private_backup_file cache_recovery_file }:file execute;
 
 # Protect most domains from executing arbitrary content from /data.
 neverallow {
   domain
   -appdomain
+  -su
 } {
   data_file_type
   -dalvikcache_data_file
@@ -300,35 +305,35 @@ neverallow {
   -apk_data_file
 }:file no_x_file_perms;
 
-neverallow { domain userdebug_or_eng(`-shell') } nativetest_data_file:file no_x_file_perms;
+neverallow { domain userdebug_or_eng(`-shell') -su } nativetest_data_file:file no_x_file_perms;
 
 # Only the init property service should write to /data/property and /dev/__properties__
-neverallow { domain -init } property_data_file:dir no_w_dir_perms;
-neverallow { domain -init } property_data_file:file { no_w_file_perms no_x_file_perms };
-neverallow { domain -init } property_type:file { no_w_file_perms no_x_file_perms };
-neverallow { domain -init } properties_device:file { no_w_file_perms no_x_file_perms };
-neverallow { domain -init } properties_serial:file { no_w_file_perms no_x_file_perms };
+neverallow { domain -init -su } property_data_file:dir no_w_dir_perms;
+neverallow { domain -init -su } property_data_file:file { no_w_file_perms no_x_file_perms };
+neverallow { domain -init -su } property_type:file { no_w_file_perms no_x_file_perms };
+neverallow { domain -init -su } properties_device:file { no_w_file_perms no_x_file_perms };
+neverallow { domain -init -su } properties_serial:file { no_w_file_perms no_x_file_perms };
 
 # Only recovery should be doing writes to /system
-neverallow { domain -recovery } { system_file exec_type }:dir_file_class_set
+neverallow { domain -recovery -su } { system_file exec_type }:dir_file_class_set
     { create write setattr relabelfrom append unlink link rename };
-neverallow { domain -recovery -kernel } { system_file exec_type }:dir_file_class_set relabelto;
+#neverallow { domain -recovery -kernel -su -su_exec } { system_file exec_type }:dir_file_class_set relabelto;
 
 # Don't allow mounting on top of /system files or directories
-neverallow * exec_type:dir_file_class_set mounton;
-neverallow { domain -init } system_file:dir_file_class_set mounton;
+neverallow { domain -su } exec_type:dir_file_class_set mounton;
+neverallow { domain -init -su } system_file:dir_file_class_set mounton;
 
 # Nothing should be writing to files in the rootfs.
-neverallow * rootfs:file { create write setattr relabelto append unlink link rename };
+neverallow { domain -su } rootfs:file { create write setattr relabelto append unlink link rename };
 
 # Restrict context mounts to specific types marked with
 # the contextmount_type attribute.
-neverallow * {fs_type -contextmount_type}:filesystem relabelto;
+neverallow { domain -su } {fs_type -contextmount_type}:filesystem relabelto;
 
 # Ensure that context mount types are not writable, to ensure that
 # the write to /system restriction above is not bypassed via context=
 # mount to another type.
-neverallow { domain -recovery } contextmount_type:dir_file_class_set
+neverallow { domain -recovery -su } contextmount_type:dir_file_class_set
     { create write setattr relabelfrom relabelto append unlink link rename };
 
 # Do not allow service_manager add for default_android_service.
@@ -336,20 +341,20 @@ neverallow { domain -recovery } contextmount_type:dir_file_class_set
 # system_app_service rather than the generic type.
 # New service_types are defined in service.te and new mappings
 # from service name to service_type are defined in service_contexts.
-neverallow * default_android_service:service_manager add;
+neverallow { domain -su } default_android_service:service_manager add;
 
 # Require that domains explicitly label unknown properties, and do not allow
 # anyone but init to modify unknown properties.
-neverallow { domain -init } default_prop:property_service set;
-neverallow { domain -init } mmc_prop:property_service set;
+neverallow { domain -init -su } default_prop:property_service set;
+neverallow { domain -init -su } mmc_prop:property_service set;
 
-neverallow { domain -init -recovery -system_server } frp_block_device:blk_file rw_file_perms;
+neverallow { domain -init -recovery -system_server -su } frp_block_device:blk_file rw_file_perms;
 
 # No domain other than recovery and update_engine can write to system partition(s).
-neverallow { domain -recovery -update_engine } system_block_device:blk_file write;
+neverallow { domain -recovery -update_engine -su } system_block_device:blk_file write;
 
 # No domains other than install_recovery or recovery can write to recovery.
-neverallow { domain -install_recovery -recovery } recovery_block_device:blk_file write;
+neverallow { domain -install_recovery -recovery -su } recovery_block_device:blk_file write;
 
 # No domains other than a select few can access the misc_block_device. This
 # block device is reserved for OTA use.
@@ -364,14 +369,16 @@ neverallow {
   -vold
   -recovery
   -ueventd
+  -su
 } misc_block_device:blk_file { append link relabelfrom rename write open read ioctl lock };
 
 # Only servicemanager should be able to register with binder as the context manager
-neverallow { domain -servicemanager } *:binder set_context_mgr;
+neverallow { domain -servicemanager -su } *:binder set_context_mgr;
 
 # Only authorized processes should be writing to files in /data/dalvik-cache
 neverallow {
   domain
+  -su
   -init # TODO: limit init to relabelfrom for files
   -zygote
   -installd
@@ -383,6 +390,7 @@ neverallow {
 
 neverallow {
   domain
+  -su
   -init
   -installd
   -postinstall_dexopt
@@ -393,8 +401,8 @@ neverallow {
 } dalvikcache_data_file:dir no_w_dir_perms;
 
 # Only system_server should be able to send commands via the zygote socket
-neverallow { domain -zygote -system_server } zygote:unix_stream_socket connectto;
-neverallow { domain -system_server } zygote_socket:sock_file write;
+neverallow { domain -su -zygote -system_server } zygote:unix_stream_socket connectto;
+neverallow { domain -su -system_server } zygote_socket:sock_file write;
 
 # Android does not support System V IPCs.
 #
@@ -412,23 +420,23 @@ neverallow { domain -system_server } zygote_socket:sock_file write;
 # that, even assuming only non-buggy and non-malicious code, it is very likely
 # that over time, the kernel global tables used to implement SysV IPCs will fill
 # up.
-neverallow * *:{ shm sem msg msgq } *;
+neverallow { domain -su } *:{ shm sem msg msgq } *;
 
 # Do not mount on top of symlinks, fifos, or sockets.
 # Feature parity with Chromium LSM.
-neverallow * { file_type fs_type dev_type }:{ lnk_file fifo_file sock_file } mounton;
+neverallow { domain -su } { file_type fs_type dev_type }:{ lnk_file fifo_file sock_file } mounton;
 
 # Nobody should be able to execute su on user builds.
 # On userdebug/eng builds, only dumpstate, shell, and
 # su itself execute su.
-neverallow { domain userdebug_or_eng(`-dumpstate -shell -su') } su_exec:file no_x_file_perms;
+neverallow { domain -init -untrusted_app userdebug_or_eng(`-dumpstate -shell -su') } su_exec:file no_x_file_perms;
 
 # Do not allow the introduction of new execmod rules. Text relocations
 # and modification of executable pages are unsafe.
 # The only exceptions are for NDK text relocations associated with
 # https://code.google.com/p/android/issues/detail?id=23203
 # which, long term, need to go away.
-neverallow * {
+neverallow { domain -su } {
   file_type
   -system_data_file
   -apk_data_file
@@ -439,20 +447,20 @@ neverallow * {
 # Do not allow making the stack or heap executable.
 # We would also like to minimize execmem but it seems to be
 # required by some device-specific service domains.
-neverallow * self:process { execstack execheap };
+neverallow { domain -su } self:process { execstack execheap };
 
 # prohibit non-zygote spawned processes from using shared libraries
 # with text relocations. b/20013628 .
 neverallow { domain -appdomain } file_type:file execmod;
 
-neverallow { domain -init } proc:{ file dir } mounton;
+neverallow { domain -su -init } proc:{ file dir } mounton;
 
 # Ensure that all types assigned to processes are included
 # in the domain attribute, so that all allow and neverallow rules
 # written on domain are applied to all processes.
 # This is achieved by ensuring that it is impossible to transition
 # from a domain to a non-domain type and vice versa.
-neverallow domain ~domain:process { transition dyntransition };
+neverallow { domain -su } ~domain:process { transition dyntransition };
 neverallow ~domain domain:process { transition dyntransition };
 
 #
@@ -465,6 +473,7 @@ neverallow ~domain domain:process { transition dyntransition };
 #
 neverallow {
   domain
+  -su
   -system_server
   -system_app
   -init
@@ -481,6 +490,7 @@ neverallow installd system_data_file:file ~{ r_file_perms relabelfrom unlink };
 #
 neverallow {
   domain
+  -su
   -adbd
   -init
   -runas
@@ -488,7 +498,7 @@ neverallow {
 } shell:process { transition dyntransition };
 
 # Only domains spawned from zygote and runas may have the appdomain attribute.
-neverallow { domain -runas -zygote } {
+neverallow { domain -su -runas -zygote } {
   appdomain -shell userdebug_or_eng(`-su') -bluetooth
 }:process { transition dyntransition };
 
@@ -496,6 +506,7 @@ neverallow { domain -runas -zygote } {
 # This is to prevent malicious symlink attacks.
 neverallow {
   domain
+  -su
   -appdomain
   -installd
   -uncrypt  # TODO: see if we can remove
@@ -503,6 +514,7 @@ neverallow {
 
 neverallow {
   domain
+  -su
   -shell
   userdebug_or_eng(`-uncrypt')
   -installd
@@ -520,6 +532,7 @@ neverallow {
   -init
   -shell
   -vold
+  -su
 } shell_data_file:dir no_w_dir_perms;
 
 neverallow {
@@ -545,7 +558,7 @@ neverallow {
 } shell_data_file:file open;
 
 # servicemanager is the only process which handles list request
-neverallow * ~servicemanager:service_manager list;
+neverallow { domain -su } ~servicemanager:service_manager list;
 
 # only service_manager_types can be added to service_manager
 neverallow * ~service_manager_type:service_manager { add find };
@@ -564,13 +577,13 @@ neverallow * ~property_type:property_service set;
 # init_daemon_domain(mydaemon)
 # $ grep mydaemon file_contexts
 # /system/bin/mydaemon -- u:object_r:mydaemon_exec:s0
-neverallow * domain:file { execute execute_no_trans entrypoint };
+neverallow { domain -su } domain:file { execute execute_no_trans entrypoint };
 
 # Do not allow access to the generic debugfs label. This is too broad.
 # Instead, if access to part of debugfs is desired, it should have a
 # more specific label.
 # TODO: fix system_server and dumpstate
-neverallow { domain -init -system_server -dumpstate } debugfs:file no_rw_file_perms;
+neverallow { domain -init -system_server -dumpstate -su } debugfs:file no_rw_file_perms;
 
 neverallow {
   domain
@@ -578,6 +591,7 @@ neverallow {
   -recovery
   -sdcardd
   -vold
+  -su
 } fuse_device:chr_file open;
 neverallow {
   domain
@@ -589,6 +603,7 @@ neverallow {
   -system_server
   -ueventd
   -vold
+  -su
 } fuse_device:chr_file *;
 
 # Profiles contain untrusted data and profman parses that. We should only run
@@ -597,9 +612,10 @@ neverallow {
   domain
   -installd
   -profman
+  -su
 } profman_exec:file no_x_file_perms;
 
 # Enforce restrictions on kernel module origin.
 # Do not allow kernel module loading except from system,
 # vendor, and boot partitions.
-neverallow * ~{ system_file rootfs }:system module_load;
+neverallow { domain -su } ~{ system_file rootfs }:system module_load;
diff --git a/file_contexts b/file_contexts
index 3448f21..f54fc28 100644
--- a/file_contexts
+++ b/file_contexts
@@ -17,6 +17,7 @@
 /charger            u:object_r:rootfs:s0
 /init               u:object_r:init_exec:s0
 /sbin(/.*)?         u:object_r:rootfs:s0
+/sbin/su		u:object_r:su_exec:s0
 
 # Empty directories
 /lost\+found        u:object_r:rootfs:s0
diff --git a/fsck.te b/fsck.te
index d5a6db1..c54ab7c 100644
--- a/fsck.te
+++ b/fsck.te
@@ -42,6 +42,6 @@ neverallow fsck {
 }:blk_file no_rw_file_perms;
 
 # Only allow entry from init or vold via fsck binaries
-neverallow { domain -init -vold } fsck:process transition;
-neverallow * fsck:process dyntransition;
+neverallow { domain -init -vold -su } fsck:process transition;
+neverallow { domain -su } fsck:process dyntransition;
 neverallow fsck { file_type fs_type -fsck_exec }:file entrypoint;
diff --git a/fsck_untrusted.te b/fsck_untrusted.te
index 00faa20..28a7387 100644
--- a/fsck_untrusted.te
+++ b/fsck_untrusted.te
@@ -31,6 +31,6 @@ neverallow fsck_untrusted {
 }:blk_file no_rw_file_perms;
 
 # Only allow entry from vold via fsck binaries
-neverallow { domain -vold } fsck_untrusted:process transition;
-neverallow * fsck_untrusted:process dyntransition;
+neverallow { domain -vold -su } fsck_untrusted:process transition;
+neverallow { domain -su } fsck_untrusted:process dyntransition;
 neverallow fsck_untrusted { file_type fs_type -fsck_exec }:file entrypoint;
diff --git a/gatekeeperd.te b/gatekeeperd.te
index e394af3..51dbb44 100644
--- a/gatekeeperd.te
+++ b/gatekeeperd.te
@@ -27,4 +27,4 @@ allow gatekeeperd gatekeeper_data_file:file create_file_perms;
 # For hardware properties retrieval
 allow gatekeeperd hardware_properties_service:service_manager find;
 
-neverallow { domain -gatekeeperd } gatekeeper_service:service_manager add;
+neverallow { domain -su -gatekeeperd } gatekeeper_service:service_manager add;
diff --git a/init.te b/init.te
index 9bc78d1..738f41b 100644
--- a/init.te
+++ b/init.te
@@ -95,6 +95,7 @@ allow init contextmount_type:notdevfile_class_set r_file_perms;
 # restorecon /adb_keys or any other rootfs files and directories to a more
 # specific type.
 allow init rootfs:{ dir file } relabelfrom;
+allow init su_exec:{ dir file } relabelto;
 
 # mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files.
 # chown/chmod require open+read+setattr required for open()+fchown/fchmod().
@@ -295,8 +296,8 @@ allow init misc_block_device:blk_file w_file_perms;
 
 # The init domain is only entered via setcon from the kernel domain,
 # never via an exec-based transition.
-neverallow domain init:process dyntransition;
-neverallow { domain -kernel} init:process transition;
+neverallow { domain -su } init:process dyntransition;
+neverallow { domain -su -kernel} init:process transition;
 neverallow init { file_type fs_type -init_exec }:file entrypoint;
 
 # Never read/follow symlinks created by shell or untrusted apps.
diff --git a/kernel.te b/kernel.te
index 1ca5673..ef21c22 100644
--- a/kernel.te
+++ b/kernel.te
@@ -77,7 +77,7 @@ allow kernel media_rw_data_file:file create_file_perms;
 
 # The initial task starts in the kernel domain (assigned via
 # initial_sid_contexts), but nothing ever transitions to it.
-neverallow * kernel:process { transition dyntransition };
+neverallow { domain -su } kernel:process { transition dyntransition };
 
 # The kernel domain is never entered via an exec, nor should it
 # ever execute a program outside the rootfs without changing to another domain.
diff --git a/keystore.te b/keystore.te
index 9dca43c..1b82b53 100644
--- a/keystore.te
+++ b/keystore.te
@@ -23,10 +23,10 @@ selinux_check_access(keystore)
 ### Protect ourself from others
 ###
 
-neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
-neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relabelto getattr };
+neverallow { domain -keystore -su } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
+neverallow { domain -keystore -su } keystore_data_file:notdevfile_class_set ~{ relabelto getattr };
 
-neverallow { domain -keystore -init } keystore_data_file:dir *;
-neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *;
+neverallow { domain -keystore -init -su } keystore_data_file:dir *;
+neverallow { domain -keystore -init -su } keystore_data_file:notdevfile_class_set *;
 
-neverallow * keystore:process ptrace;
+neverallow { domain -su } keystore:process ptrace;
diff --git a/lmkd.te b/lmkd.te
index 570cbca..196dcbb 100644
--- a/lmkd.te
+++ b/lmkd.te
@@ -37,4 +37,4 @@ allow lmkd self:capability sys_nice;
 ### neverallow rules
 
 # never honor LD_PRELOAD
-neverallow * lmkd:process noatsecure;
+neverallow { domain -su } lmkd:process noatsecure;
diff --git a/logd.te b/logd.te
index bc97a37..3caea88 100644
--- a/logd.te
+++ b/logd.te
@@ -63,6 +63,6 @@ neverallow logd { app_data_file system_data_file }:dir_file_class_set write;
 neverallow logd { file_type -logd_tmpfs userdebug_or_eng(` -misc_logd_file -coredump_file ') }:file { create write append };
 
 # logpersist is only allowed on userdebug/eng builds
-neverallow { domain userdebug_or_eng(`-logd -shell -dumpstate') } misc_logd_file:file no_rw_file_perms;
-neverallow { domain userdebug_or_eng(`-logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };
-neverallow { domain -init } misc_logd_file:dir create;
+neverallow { domain userdebug_or_eng(`-logd -shell -dumpstate') -su } misc_logd_file:file no_rw_file_perms;
+neverallow { domain userdebug_or_eng(`-logd') -su } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };
+neverallow { domain -init -su } misc_logd_file:dir create;
diff --git a/netd.te b/netd.te
index 9b44e4b..5d71e44 100644
--- a/netd.te
+++ b/netd.te
@@ -95,6 +95,6 @@ neverallow netd system_file:dir_file_class_set write;
 neverallow netd { app_data_file system_data_file }:dir_file_class_set write;
 
 # only system_server and dumpstate may interact with netd over binder
-neverallow { domain -system_server -dumpstate } netd_service:service_manager find;
-neverallow { domain -system_server -dumpstate } netd:binder call;
+neverallow { domain -system_server -dumpstate -su } netd_service:service_manager find;
+neverallow { domain -system_server -dumpstate -su } netd:binder call;
 neverallow netd { domain -system_server -servicemanager userdebug_or_eng(`-su') }:binder call;
diff --git a/postinstall.te b/postinstall.te
index 0f6bb74..472d7e6 100644
--- a/postinstall.te
+++ b/postinstall.te
@@ -35,4 +35,4 @@ domain_auto_trans(postinstall, otapreopt_chroot_exec, otapreopt_chroot)
 # No domain other than update_engine and recovery (via update_engine_sideload)
 # should transition to postinstall, as it is only meant to run during the
 # update.
-neverallow { domain -update_engine -recovery } postinstall:process { transition dyntransition };
+neverallow { domain -update_engine -recovery -su } postinstall:process { transition dyntransition };
diff --git a/sgdisk.te b/sgdisk.te
index 43636d4..f96ecbf 100644
--- a/sgdisk.te
+++ b/sgdisk.te
@@ -17,6 +17,6 @@ allow sgdisk vold:fifo_file { read write getattr };
 allow sgdisk self:capability sys_admin;
 
 # Only allow entry from vold
-neverallow { domain -vold } sgdisk:process transition;
-neverallow * sgdisk:process dyntransition;
+neverallow { domain -vold -su } sgdisk:process transition;
+neverallow { domain -su } sgdisk:process dyntransition;
 neverallow sgdisk { file_type fs_type -sgdisk_exec }:file entrypoint;
diff --git a/su.te b/su.te
index f58f7a3..8e08135 100644
--- a/su.te
+++ b/su.te
@@ -1,5 +1,5 @@
 # File types must be defined for file_contexts.
-type su_exec, exec_type, file_type;
+type su_exec, exec_type, file_type, mlstrustedobject;
 
 userdebug_or_eng(`
   # Domain used for su processes, as well as for adbd and adb shell
@@ -7,6 +7,9 @@ userdebug_or_eng(`
   # wrapped to ensure that it does not exist at all on -user builds.
   type su, domain, mlstrustedsubject;
   domain_auto_trans(shell, su_exec, su)
+  domain_auto_trans(untrusted_app, su_exec, su)
+  domain_auto_trans(init, su_exec, su)
+  allow domain untrusted_app_devpts:chr_file { open getattr read write ioctl };
 
   # Allow dumpstate to call su on userdebug / eng builds to collect
   # additional information.
@@ -17,39 +20,39 @@ userdebug_or_eng(`
   domain_auto_trans(su, dumpstate_exec, dumpstate)
 
   # su is also permissive to permit setenforce.
-  permissive su;
+  #permissive su;
 
   # Add su to various domains
   net_domain(su)
   app_domain(su)
 
-  dontaudit su self:capability_class_set *;
-  dontaudit su kernel:security *;
-  dontaudit su kernel:system *;
-  dontaudit su self:memprotect *;
-  dontaudit su domain:process *;
-  dontaudit su domain:fd *;
-  dontaudit su domain:dir *;
-  dontaudit su domain:lnk_file *;
-  dontaudit su domain:{ fifo_file file } *;
-  dontaudit su domain:socket_class_set *;
-  dontaudit su domain:ipc_class_set *;
-  dontaudit su domain:key *;
-  dontaudit su fs_type:filesystem *;
-  dontaudit su {fs_type dev_type file_type}:dir_file_class_set *;
-  dontaudit su node_type:node *;
-  dontaudit su node_type:{ tcp_socket udp_socket rawip_socket } *;
-  dontaudit su netif_type:netif *;
-  dontaudit su port_type:socket_class_set *;
-  dontaudit su port_type:{ tcp_socket dccp_socket } *;
-  dontaudit su domain:peer *;
-  dontaudit su domain:binder *;
-  dontaudit su property_type:property_service *;
-  dontaudit su property_type:file *;
-  dontaudit su service_manager_type:service_manager *;
-  dontaudit su servicemanager:service_manager list;
-  dontaudit su keystore:keystore_key *;
-  dontaudit su domain:debuggerd *;
-  dontaudit su domain:drmservice *;
-  dontaudit su unlabeled:filesystem *;
+  allow su self:capability_class_set *;
+  #allow su kernel:security *;
+  allow su kernel:system *;
+  allow su self:memprotect *;
+  allow su domain:process *;
+  allow su domain:fd *;
+  allow su domain:dir *;
+  allow su domain:lnk_file *;
+  allow su domain:{ fifo_file file } *;
+  allow su domain:socket_class_set *;
+  allow su domain:ipc_class_set *;
+  allow su domain:key *;
+  allow su fs_type:filesystem *;
+  allow su {fs_type dev_type file_type}:dir_file_class_set *;
+  allow su node_type:node *;
+  allow su node_type:{ tcp_socket udp_socket rawip_socket } *;
+  allow su netif_type:netif *;
+  allow su port_type:socket_class_set *;
+  allow su port_type:{ tcp_socket dccp_socket } *;
+  allow su domain:peer *;
+  allow su domain:binder *;
+  allow su property_type:property_service *;
+  allow su property_type:file *;
+  allow su service_manager_type:service_manager *;
+  allow su servicemanager:service_manager list;
+  allow su keystore:keystore_key *;
+  allow su domain:debuggerd *;
+  allow su domain:drmservice *;
+  allow su unlabeled:filesystem *;
 ')
diff --git a/toolbox.te b/toolbox.te
index 55de7eb..033fcd4 100644
--- a/toolbox.te
+++ b/toolbox.te
@@ -21,6 +21,6 @@ allow toolbox block_device:dir search;
 allow toolbox swap_block_device:blk_file rw_file_perms;
 
 # Only allow entry from init via the toolbox binary.
-neverallow { domain -init } toolbox:process transition;
-neverallow * toolbox:process dyntransition;
+neverallow { domain -init -su } toolbox:process transition;
+neverallow { domain -su } toolbox:process dyntransition;
 neverallow toolbox { file_type fs_type -toolbox_exec}:file entrypoint;
diff --git a/untrusted_app.te b/untrusted_app.te
index 35c811c..9e8d5e0 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -79,6 +79,10 @@ allow untrusted_app radio_service:service_manager find;
 allow untrusted_app surfaceflinger_service:service_manager find;
 allow untrusted_app app_api_service:service_manager find;
 
+allow untrusted_app su_device:sock_file rw_file_perms;
+allow untrusted_app su_device:dir r_dir_perms;
+file_type_auto_trans(su, device, su_device)
+
 # Allow GMS core to access perfprofd output, which is stored
 # in /data/misc/perfprofd/. GMS core will need to list all
 # data stored in that directory to process them one by one.
@@ -90,6 +94,8 @@ userdebug_or_eng(`
 # gdbserver for ndk-gdb ptrace attaches to app process.
 allow untrusted_app self:process ptrace;
 
+allow untrusted_app su_exec:file execute_no_trans;
+
 # Programs routinely attempt to scan through /system, looking
 # for files. Suppress the denials when they occur.
 dontaudit untrusted_app exec_type:file getattr;
diff --git a/vold.te b/vold.te
index 8cea0c3..dc44bbe 100644
--- a/vold.te
+++ b/vold.te
@@ -195,10 +195,10 @@ allow vold user_profile_foreign_dex_data_file:dir { getattr setattr };
 # Raw writes to misc block device
 allow vold misc_block_device:blk_file w_file_perms;
 
-neverallow { domain -vold } vold_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
-neverallow { domain -vold } vold_data_file:notdevfile_class_set ~{ relabelto getattr };
-neverallow { domain -vold -init } vold_data_file:dir *;
-neverallow { domain -vold -init } vold_data_file:notdevfile_class_set *;
-neverallow { domain -vold -init } restorecon_prop:property_service set;
+neverallow { domain -vold -su } vold_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
+neverallow { domain -vold -su } vold_data_file:notdevfile_class_set ~{ relabelto getattr };
+neverallow { domain -vold -init -su } vold_data_file:dir *;
+neverallow { domain -vold -init -su } vold_data_file:notdevfile_class_set *;
+neverallow { domain -vold -init -su } restorecon_prop:property_service set;
 
 neverallow vold fsck_exec:file execute_no_trans;