Remove access to /proc/net/{tcp,udp}
Remove these files from proc_net_type. Domains that need access must
have permission explicitly granted. Neverallow app access except the
shell domain.
Bug: 114475727
Test: atest CtsLibcoreOjTestCases
Test: netstat, lsof
Test: adb bugreport
Change-Id: I2304e3e98c0d637af78a361569466aa2fbe79fa0
diff --git a/private/shell.te b/private/shell.te
index 7b52a02..ee5b73c 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -57,3 +57,6 @@
# Allow shell to use atrace HAL
hal_client_domain(shell, hal_atrace)
+
+# For hostside tests such as CTS listening ports test.
+allow shell proc_net_tcp_udp:file r_file_perms;