tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/net.te

26 lines
852 B
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
# Network types
type node, node_type;
type netif, netif_type;
type port, port_type;
Restore netdomain allow rules. Change I4be1c987a5d69ac784a56d42fc2c9063c402de11 removed all netdomain allow rules at the same time domains were made unconfined. Prior to that change, any domain that used the net_domain() macro would be granted permissions required to use the network via these rules. The change made the netdomain attribute unused in any rules, thereby rendering the net_domain() calls pointless and requiring the allow rules to be duplicated for any domain requiring network access. There are two ways to resolve this inconsistency: 1. Restore the netdomain rules as in this change. In that case, some rules in app.te can be removed as they are redundant with these rules. -or- 2. Completely remove the netdomain attribute, the net_domain() macro, and all calls to it. In that case, each domain that requires network access will need to duplicate these rules or the necessary subset in order to function. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Change-Id: Ia54f0cd0bbda5c510423b1046626bd50f79ed7b6
2013-09-30 21:07:55 +02:00
# Use network sockets.
Resolve overlapping rules between app.te and net.te. There is some overlap between socket rules in app.te and the net.te rules, but they aren't quite identical since not all app domains presently include the net_domain() macro and because the rules in app.te allow more permissions for netlink_route_socket and allow rawip_socket permissions for ping. The current app.te rules prevent one from ever creating a non-networked app domain. Resolve this overlap by: 1) Adding the missing permissions allowed by app.te to net.te for netlink_route_socket and rawip_socket. 2) Adding net_domain() calls to all existing app domains that do not already have it. 3) Deleting the redundant socket rules from app.te. Then we'll have no effective change in what is allowed for apps but allow one to define app domains in the future that are not allowed network access. Also cleanup net.te to use the create_socket_perms macro rather than * and add macros for stream socket permissions. Change-Id: I6e80d65b0ccbd48bd2b7272c083a4473e2b588a9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 16:48:03 +01:00
allow netdomain self:tcp_socket create_stream_socket_perms;
allow netdomain self:{ udp_socket rawip_socket } create_socket_perms;
Restore netdomain allow rules. Change I4be1c987a5d69ac784a56d42fc2c9063c402de11 removed all netdomain allow rules at the same time domains were made unconfined. Prior to that change, any domain that used the net_domain() macro would be granted permissions required to use the network via these rules. The change made the netdomain attribute unused in any rules, thereby rendering the net_domain() calls pointless and requiring the allow rules to be duplicated for any domain requiring network access. There are two ways to resolve this inconsistency: 1. Restore the netdomain rules as in this change. In that case, some rules in app.te can be removed as they are redundant with these rules. -or- 2. Completely remove the netdomain attribute, the net_domain() macro, and all calls to it. In that case, each domain that requires network access will need to duplicate these rules or the necessary subset in order to function. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Change-Id: Ia54f0cd0bbda5c510423b1046626bd50f79ed7b6
2013-09-30 21:07:55 +02:00
# Connect to ports.
allow netdomain port_type:tcp_socket name_connect;
# Bind to ports.
allow netdomain node_type:{ tcp_socket udp_socket } node_bind;
allow netdomain port_type:udp_socket name_bind;
allow netdomain port_type:tcp_socket name_bind;
Resolve overlapping rules between app.te and net.te. There is some overlap between socket rules in app.te and the net.te rules, but they aren't quite identical since not all app domains presently include the net_domain() macro and because the rules in app.te allow more permissions for netlink_route_socket and allow rawip_socket permissions for ping. The current app.te rules prevent one from ever creating a non-networked app domain. Resolve this overlap by: 1) Adding the missing permissions allowed by app.te to net.te for netlink_route_socket and rawip_socket. 2) Adding net_domain() calls to all existing app domains that do not already have it. 3) Deleting the redundant socket rules from app.te. Then we'll have no effective change in what is allowed for apps but allow one to define app domains in the future that are not allowed network access. Also cleanup net.te to use the create_socket_perms macro rather than * and add macros for stream socket permissions. Change-Id: I6e80d65b0ccbd48bd2b7272c083a4473e2b588a9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 16:48:03 +01:00
# See changes to the routing table.
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
allow netdomain self:netlink_route_socket { create_socket_perms nlmsg_read };
Restore netdomain allow rules. Change I4be1c987a5d69ac784a56d42fc2c9063c402de11 removed all netdomain allow rules at the same time domains were made unconfined. Prior to that change, any domain that used the net_domain() macro would be granted permissions required to use the network via these rules. The change made the netdomain attribute unused in any rules, thereby rendering the net_domain() calls pointless and requiring the allow rules to be duplicated for any domain requiring network access. There are two ways to resolve this inconsistency: 1. Restore the netdomain rules as in this change. In that case, some rules in app.te can be removed as they are redundant with these rules. -or- 2. Completely remove the netdomain attribute, the net_domain() macro, and all calls to it. In that case, each domain that requires network access will need to duplicate these rules or the necessary subset in order to function. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Change-Id: Ia54f0cd0bbda5c510423b1046626bd50f79ed7b6
2013-09-30 21:07:55 +02:00
# Talks to netd via dnsproxyd socket.
unix_socket_connect(netdomain, dnsproxyd, netd)
Add a domain for mdnsd and allow connecting to it. Change-Id: I0a06fa32a46e515671b4e9a6f68e1a3f8b2c21a8 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 19:04:49 +01:00
Introduce fwmarkd: a service to set the fwmark of sockets. (cherry picked from commit 7d51096d4106a441a15741592d9ccdd0bfaca907) Change-Id: Ib6198e19dbc306521a26fcecfdf6e8424d163fc9
2014-05-01 20:12:10 +02:00
# Talks to netd via fwmarkd socket.
unix_socket_connect(netdomain, fwmarkd, netd)
Add a domain for mdnsd and allow connecting to it. Change-Id: I0a06fa32a46e515671b4e9a6f68e1a3f8b2c21a8 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 19:04:49 +01:00
# Connect to mdnsd via mdnsd socket.
unix_socket_connect(netdomain, mdnsd, mdnsd)
Reference in a new issue Copy permalink