[Thread] limit ot-daemon socket to ot-ctl
It's better to explicitly disallow access to ot-daemon from other than
ot-ctl.
Bug: 323502847
Change-Id: Ic46ad4e8f3a1d21bbfc9f4f01e6a692aafcdb815
diff --git a/private/ot_daemon.te b/private/ot_daemon.te
index 341fa9c..2fc74b5 100644
--- a/private/ot_daemon.te
+++ b/private/ot_daemon.te
@@ -39,3 +39,12 @@
# For collecting bugreports.
allow ot_daemon dumpstate:fd use;
allow ot_daemon dumpstate:fifo_file write;
+
+# ot-daemon socket is for only ot-daemon and ot-ctl
+neverallow {
+ domain
+ -ot_daemon
+ userdebug_or_eng(`-ot_ctl')
+ -init
+ -vendor_init
+} ot_daemon_socket:sock_file *;