diff options
| author | Jeff Vander Stoep <jeffv@google.com> | 2016-01-05 13:16:34 -0800 |
|---|---|---|
| committer | The Android Automerger <android-build@google.com> | 2016-02-26 16:55:55 -0800 |
| commit | 489e0b567f902f36e38a1b888105da043677b621 (patch) | |
| tree | eb297780fa3532659f915bf9b54f33a7dc48bbe1 | |
| parent | 9acda2f3805c426c18af62b98aac614f69f97864 (diff) | |
| download | android_external_sepolicy-489e0b567f902f36e38a1b888105da043677b621.tar.gz android_external_sepolicy-489e0b567f902f36e38a1b888105da043677b621.tar.bz2 android_external_sepolicy-489e0b567f902f36e38a1b888105da043677b621.zip | |
DO NOT MERGE: Further restrict access to socket ioctl commands
Remove untrusted/isolated app access to device private commands.
Only allow shell user to access unprivileged socket ioctl commands.
Bug: 26324307
Bug: 26267358
Change-Id: Iddf1171bc05c7600e0292f925d18d748f13a98f2
| -rw-r--r-- | ioctl_macros | 14 | ||||
| -rw-r--r-- | shell.te | 3 |
2 files changed, 12 insertions, 5 deletions
diff --git a/ioctl_macros b/ioctl_macros index e71e0ce..6012568 100644 --- a/ioctl_macros +++ b/ioctl_macros @@ -1,11 +1,15 @@ # socket ioctls allowed to unprivileged apps define(`unpriv_sock_ioctls', ` { -# all socket ioctls except the Mac address SIOCGIFHWADDR 0x8927 -0x8900-0x8926 0x8928-0x89ff -# all wireless extensions ioctls except get/set essid -# IOCSIWESSID 0x8B1A SIOCGIWESSID 0x8B1B -0x8B00-0x8B09 0x8B1C-0x8BFF +# all socket ioctls except: +# 1) the Mac address SIOCGIFHWADDR 0x8927 +# 2) device private SIOCDEVPRIVATE-SIOCDEVPRIVLAST 0x89F0-0x89FF +# 3) protocol private SIOCPROTOPRIVATE-SIOCPROTOPRIVLAST 0x89E0-0x89EF +0x8900-0x8926 0x8928-0x89DF +# all wireless extensions ioctls except: +# 1) get/set essid IOCSIWESSID 0x8B1A SIOCGIWESSID 0x8B1B +# 2) device private ioctls SIOCIWFIRSTPRIV-SIOCIWLASTPRIV 0x8BE0-0x8BFF +0x8B00-0x8B09 0x8B1C-0x8BDF # commonly used TTY ioctls 0x5411 0x5451 }') @@ -77,6 +77,9 @@ allow shell domain:process getattr; allow shell bootchart_data_file:dir rw_dir_perms; allow shell bootchart_data_file:file create_file_perms; +# only allow unprivileged socket ioctl commands +allow shell self:{ rawip_socket tcp_socket udp_socket } unpriv_sock_ioctls; + # Do not allow shell to hard link to any files. # In particular, if shell hard links to app data # files, installd will not be able to guarantee the deletion |