Restrict SDK sandbox unix_stream_socket connections
Bug: 328729812
Test: atest --test-mapping packages/modules/AdServices/sdksandbox
Change-Id: If26e853d66039aebead20076df4387cd6ca9788d
diff --git a/private/app.te b/private/app.te
index b0b5dbb..07e0be0 100644
--- a/private/app.te
+++ b/private/app.te
@@ -407,7 +407,13 @@
# hence no sock_file or connectto permission. This appears to be how
# Chrome works, may need to be updated as more apps using isolated services
# are examined.
-allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown };
+allow {
+ appdomain
+ -sdk_sandbox_all
+} {
+ appdomain
+ -sdk_sandbox_all
+}:unix_stream_socket { getopt getattr read write shutdown };
# Backup ability for every app. BMS opens and passes the fd
# to any app that has backup ability. Hence, no open permissions here.