diff options
| author | Nick Kralevich <nnk@google.com> | 2015-08-28 03:57:24 +0000 |
|---|---|---|
| committer | Android Git Automerger <android-git-automerger@android.com> | 2015-08-28 03:57:24 +0000 |
| commit | a045ca42ccf6aba69901b06942c65d4eb2c8147c (patch) | |
| tree | d94fdd6620472d95240d24614e081591bbc23efd | |
| parent | b5dd69a1aa92cf1b9f2ca9d65f66fc31b0b54db6 (diff) | |
| parent | 87f3802a8edcb1ee9668417b118844132a207df0 (diff) | |
| download | android_external_sepolicy-a045ca42ccf6aba69901b06942c65d4eb2c8147c.tar.gz android_external_sepolicy-a045ca42ccf6aba69901b06942c65d4eb2c8147c.tar.bz2 android_external_sepolicy-a045ca42ccf6aba69901b06942c65d4eb2c8147c.zip | |
am 87f3802a: appdomain: relax netlink_socket neverallow rule
* commit '87f3802a8edcb1ee9668417b118844132a207df0':
appdomain: relax netlink_socket neverallow rule
| -rw-r--r-- | app.te | 5 | ||||
| -rw-r--r-- | untrusted_app.te | 5 |
2 files changed, 6 insertions, 4 deletions
@@ -229,8 +229,7 @@ neverallow appdomain tee_device:chr_file { read write }; # Privileged netlink socket interfaces. neverallow appdomain - self:{ - netlink_socket + domain:{ netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket @@ -243,7 +242,7 @@ neverallow appdomain # These messages are broadcast messages from the kernel to userspace. # Do not allow the writing of netlink messages, which has been a source # of rooting vulns in the past. -neverallow appdomain self:netlink_kobject_uevent_socket { write append }; +neverallow appdomain domain:netlink_kobject_uevent_socket { write append }; # Sockets under /dev/socket that are not specifically typed. neverallow appdomain socket_device:sock_file write; diff --git a/untrusted_app.te b/untrusted_app.te index 2a8c170..1142b7a 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -69,7 +69,10 @@ allow untrusted_app cache_file:file create_file_perms; ### # Receive or send uevent messages. -neverallow untrusted_app self:netlink_kobject_uevent_socket *; +neverallow untrusted_app domain:netlink_kobject_uevent_socket *; + +# Receive or send generic netlink messages +neverallow untrusted_app domain:netlink_socket *; # Too much leaky information in debugfs. It's a security # best practice to ensure these files aren't readable. |