untrusted_app: disallow bind RTM_ROUTE socket
Bug: 141455849
Change-Id: I27a8735626a5c3c8aad49e8a68de166f3a10cfde
Test: CtsSelinuxTargetSdkCurrentTestCases
Test: atest bionic-unit-tests-static
Test: atest NetworkInterfaceTest
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 5c8ad88..677b9e2 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -118,7 +118,7 @@
-untrusted_app_25
-untrusted_app_27
-untrusted_app_29
-} domain:netlink_route_socket { nlmsg_readpriv };
+} domain:netlink_route_socket { bind nlmsg_readpriv };
# Do not allow untrusted apps access to /cache
neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };