Restrict functions for vold
Raw sockets usually imply advanced parsers that might
have flaws. If vold need such odd thing, force it to have
that in a other domain like filesystem checks. Debug
features like ptrace does not belong to vold.
Bug: 64791922
Test: Manual
Change-Id: I75c62d13f998621f80b2049bce0505442862bf0b
diff --git a/public/vold.te b/public/vold.te
index 99f0bb3..118244a 100644
--- a/public/vold.te
+++ b/public/vold.te
@@ -190,3 +190,5 @@
neverallow vold fsck_exec:file execute_no_trans;
neverallow { domain -init } vold:process { transition dyntransition };
+neverallow vold *:process ptrace;
+neverallow vold *:rawip_socket *;