buildtime/cts enforce no inet access for media domains
Bug: 28348382
Change-Id: Iaab1430750dfbb997900d3d70993c9fff2a8745d
diff --git a/mediacodec.te b/mediacodec.te
index adba40b..3d3625a 100644
--- a/mediacodec.te
+++ b/mediacodec.te
@@ -26,6 +26,5 @@
# domain transition
neverallow mediacodec { file_type fs_type }:file execute_no_trans;
-# mediacodec should never need network access. Disallow all sockets
-# other than those needed for normal system functions
-neverallow mediacodec { domain -debuggerd -dumpstate -adbd -mediacodec -logd userdebug_or_eng(`-su')}:socket_class_set *;
+# mediacodec should never need network access. Disallow network sockets.
+neverallow mediacodec domain:{ tcp_socket udp_socket rawip_socket } *;