Disallow relabeling vsock
There's no need for it, and we would like to be able to rely on these
labels.
Bug: 347661724
Test: Builds
Change-Id: I5a0cf5446d0b99239e8fe5d45480c4942710578c
diff --git a/private/domain.te b/private/domain.te
index 61e2ea6..c92830f 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -2235,3 +2235,6 @@
# Only init/vendor are allowed to write sysfs_pgsize_migration;
# ueventd needs write access to all sysfs files.
neverallow { domain -init -vendor_init -ueventd } sysfs_pgsize_migration:file no_w_file_perms;
+
+# We need to be able to rely on vsock labels, so disallow changing them.
+neverallow domain *:vsock_socket { relabelfrom relabelto };