| commit | b93f26fd899ba19d77af9444c9f60e4a4478070d | [log] [tgz] |
|---|---|---|
| author | Bram Bonne <brambonne@google.com> | Tue Mar 15 18:28:02 2022 +0100 |
| committer | Bram Bonne <brambonne@google.com> | Thu Mar 17 10:22:33 2022 +0100 |
| tree | 1acd57da73b0f7d8f13475d7981758f4ea97d4c1 | |
| parent | be66c59171d31446274ac3db43397f50480501db [diff] [blame] |
Move sdk_sandbox sepolicy to AOSP. Bug: 224796470 Bug: 203670791 Bug: 204989872 Bug: 211761016 Bug: 217543371 Bug: 217559719 Bug: 215105355 Bug: 220320098 Test: make, ensure device boots Change-Id: Ia96ae5407f5a83390ce1b610da0d49264e90d7e2 Merged-In: Ib085c49f29dab47268e479fe5266490a66adaa87 Merged-In: I2215ffe74e0fa19ff936e90c08c4ebfd177e5258 Merged-In: I478c9a16032dc1f1286f5295fc080cbe574f09c9 Merged-In: Ibf478466e5d6ab0ee08fca4da3b4bae974a82db0 Merged-In: I5d519605d9fbe80c7b4c9fb6572bc72425f6e90a Merged-In: I05d2071e023d0de8a93dcd111674f8d8102a21ce Merged-In: I6572a7a5c46c52c9421d0e9c9fc653ddbd6de145 Merged-In: I1b6d1a778cb658bdfd930b684e4ba0640031b226 Merged-In: I9fb98e0caee75bdaaa35d11d174004505f236799
diff --git a/private/net.te b/private/net.te new file mode 100644 index 0000000..25bd538 --- /dev/null +++ b/private/net.te
@@ -0,0 +1,17 @@ +# Bind to ports. +allow {netdomain -ephemeral_app -sdk_sandbox} node_type:{ icmp_socket rawip_socket tcp_socket udp_socket } node_bind; +allow {netdomain -ephemeral_app -sdk_sandbox} port_type:udp_socket name_bind; +allow {netdomain -ephemeral_app -sdk_sandbox} port_type:tcp_socket name_bind; + +# b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from +# untrusted_apps. +# b/171572148 gate RTM_GETNEIGH{TBL} with a new permission nlmsg_getneigh and block access from +# untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-30) are granted access elsewhere +# to avoid app-compat breakage. +allow { + netdomain + -ephemeral_app + -mediaprovider + -sdk_sandbox + -untrusted_app_all +} self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh };