| RafayKamran | eaa18ce | 2021-10-27 14:12:44 +0000 | [diff] [blame] | 1 | # Bind to ports. |
| Nikita Ioffe | e2da633 | 2022-02-21 17:55:59 +0000 | [diff] [blame^] | 2 | allow {netdomain -ephemeral_app -sdk_sandbox} node_type:{ icmp_socket rawip_socket tcp_socket udp_socket } node_bind; |
| 3 | allow {netdomain -ephemeral_app -sdk_sandbox} port_type:udp_socket name_bind; |
| 4 | allow {netdomain -ephemeral_app -sdk_sandbox} port_type:tcp_socket name_bind; |
| RafayKamran | eaa18ce | 2021-10-27 14:12:44 +0000 | [diff] [blame] | 5 | |
| 6 | # b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from |
| 7 | # untrusted_apps. |
| 8 | # b/171572148 gate RTM_GETNEIGH{TBL} with a new permission nlmsg_getneigh and block access from |
| 9 | # untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-30) are granted access elsewhere |
| 10 | # to avoid app-compat breakage. |
| 11 | allow { |
| 12 | netdomain |
| 13 | -ephemeral_app |
| 14 | -mediaprovider |
| Nikita Ioffe | e2da633 | 2022-02-21 17:55:59 +0000 | [diff] [blame^] | 15 | -sdk_sandbox |
| RafayKamran | eaa18ce | 2021-10-27 14:12:44 +0000 | [diff] [blame] | 16 | -untrusted_app_all |
| 17 | } self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh }; |
| 18 | |