diff options
| author | Nick Kralevich <nnk@google.com> | 2014-06-20 21:15:56 -0700 |
|---|---|---|
| committer | Nick Kralevich <nnk@google.com> | 2014-06-23 11:28:30 -0700 |
| commit | 0db95cce33b33259e87b41c7fa1807f562c2d7d1 (patch) | |
| tree | fd86c097e02bf0114b61886232ddc6371e7bfd4c | |
| parent | a893edae3716b33be62edf1b5f3336e6f6bb251b (diff) | |
| download | android_external_sepolicy-0db95cce33b33259e87b41c7fa1807f562c2d7d1.tar.gz android_external_sepolicy-0db95cce33b33259e87b41c7fa1807f562c2d7d1.tar.bz2 android_external_sepolicy-0db95cce33b33259e87b41c7fa1807f562c2d7d1.zip | |
unconfined: remove internet access
Don't allow unconfined domains to access the internet. Restrict
internet functionality to domains which explicitly declare their
use. Removing internet access from unconfined domains helps
protect daemons from network level attacks.
In unconfined.te, expand out socket_class_set, and explicitly remove
tcp_socket, udp_socket, rawip_socket, packet_socket, and
appletalk_socket. Remove name_bind, node_bind and name_connect rules,
since they only apply to internet accessible rules.
Add limited udp support to init.te. This is needed to bring up
the loopback interface at boot.
Change-Id: If756f3fed857f11e63a6c3a1a13263c57fdf930a
| -rw-r--r-- | init.te | 3 | ||||
| -rw-r--r-- | unconfined.te | 22 |
2 files changed, 21 insertions, 4 deletions
@@ -86,6 +86,9 @@ allow init self:process { setexec setfscreate setsockcreate }; allow init property_data_file:dir create_dir_perms; allow init property_data_file:file create_file_perms; +# Run "ifup lo" to bring up the localhost interface +allow init self:udp_socket { create ioctl }; + ### ### neverallow rules ### diff --git a/unconfined.te b/unconfined.te index d74b293..b3e374d 100644 --- a/unconfined.te +++ b/unconfined.te @@ -45,7 +45,24 @@ allow unconfineddomain domain:fd *; allow unconfineddomain domain:dir r_dir_perms; allow unconfineddomain domain:lnk_file r_file_perms; allow unconfineddomain domain:{ fifo_file file } rw_file_perms; -allow unconfineddomain domain:socket_class_set *; +allow unconfineddomain domain:{ + socket + netlink_socket + key_socket + unix_stream_socket + unix_dgram_socket + netlink_route_socket + netlink_firewall_socket + netlink_tcpdiag_socket + netlink_nflog_socket + netlink_xfrm_socket + netlink_selinux_socket + netlink_audit_socket + netlink_ip6fw_socket + netlink_dnrt_socket + netlink_kobject_uevent_socket + tun_socket +} *; allow unconfineddomain domain:ipc_class_set *; allow unconfineddomain domain:key *; allow unconfineddomain {fs_type -contextmount_type -sdcard_type}:{ dir lnk_file sock_file fifo_file } ~relabelto; @@ -89,10 +106,7 @@ allow unconfineddomain rootfs:file execute; allow unconfineddomain contextmount_type:dir r_dir_perms; allow unconfineddomain contextmount_type:notdevfile_class_set r_file_perms; allow unconfineddomain node_type:node *; -allow unconfineddomain node_type:{ tcp_socket udp_socket rawip_socket } node_bind; allow unconfineddomain netif_type:netif *; -allow unconfineddomain port_type:socket_class_set name_bind; -allow unconfineddomain port_type:{ tcp_socket dccp_socket } name_connect; allow unconfineddomain domain:peer recv; allow unconfineddomain { domain -init }:binder { call transfer set_context_mgr }; allow unconfineddomain { property_type -security_prop }:property_service set; |