tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/net.te

26 lines
914 B
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
# Network types
type node, node_type;
type netif, netif_type;
type port, port_type;
Restore netdomain allow rules. Change I4be1c987a5d69ac784a56d42fc2c9063c402de11 removed all netdomain allow rules at the same time domains were made unconfined. Prior to that change, any domain that used the net_domain() macro would be granted permissions required to use the network via these rules. The change made the netdomain attribute unused in any rules, thereby rendering the net_domain() calls pointless and requiring the allow rules to be duplicated for any domain requiring network access. There are two ways to resolve this inconsistency: 1. Restore the netdomain rules as in this change. In that case, some rules in app.te can be removed as they are redundant with these rules. -or- 2. Completely remove the netdomain attribute, the net_domain() macro, and all calls to it. In that case, each domain that requires network access will need to duplicate these rules or the necessary subset in order to function. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Change-Id: Ia54f0cd0bbda5c510423b1046626bd50f79ed7b6
2013-09-30 21:07:55 +02:00
# Use network sockets.
Resolve overlapping rules between app.te and net.te. There is some overlap between socket rules in app.te and the net.te rules, but they aren't quite identical since not all app domains presently include the net_domain() macro and because the rules in app.te allow more permissions for netlink_route_socket and allow rawip_socket permissions for ping. The current app.te rules prevent one from ever creating a non-networked app domain. Resolve this overlap by: 1) Adding the missing permissions allowed by app.te to net.te for netlink_route_socket and rawip_socket. 2) Adding net_domain() calls to all existing app domains that do not already have it. 3) Deleting the redundant socket rules from app.te. Then we'll have no effective change in what is allowed for apps but allow one to define app domains in the future that are not allowed network access. Also cleanup net.te to use the create_socket_perms macro rather than * and add macros for stream socket permissions. Change-Id: I6e80d65b0ccbd48bd2b7272c083a4473e2b588a9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 16:48:03 +01:00
allow netdomain self:tcp_socket create_stream_socket_perms;
allow netdomain self:{ udp_socket rawip_socket } create_socket_perms;
Restore netdomain allow rules. Change I4be1c987a5d69ac784a56d42fc2c9063c402de11 removed all netdomain allow rules at the same time domains were made unconfined. Prior to that change, any domain that used the net_domain() macro would be granted permissions required to use the network via these rules. The change made the netdomain attribute unused in any rules, thereby rendering the net_domain() calls pointless and requiring the allow rules to be duplicated for any domain requiring network access. There are two ways to resolve this inconsistency: 1. Restore the netdomain rules as in this change. In that case, some rules in app.te can be removed as they are redundant with these rules. -or- 2. Completely remove the netdomain attribute, the net_domain() macro, and all calls to it. In that case, each domain that requires network access will need to duplicate these rules or the necessary subset in order to function. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Change-Id: Ia54f0cd0bbda5c510423b1046626bd50f79ed7b6
2013-09-30 21:07:55 +02:00
# Connect to ports.
allow netdomain port_type:tcp_socket name_connect;
# Bind to ports.
allow netdomain node_type:{ tcp_socket udp_socket } node_bind;
allow netdomain port_type:udp_socket name_bind;
allow netdomain port_type:tcp_socket name_bind;
Resolve overlapping rules between app.te and net.te. There is some overlap between socket rules in app.te and the net.te rules, but they aren't quite identical since not all app domains presently include the net_domain() macro and because the rules in app.te allow more permissions for netlink_route_socket and allow rawip_socket permissions for ping. The current app.te rules prevent one from ever creating a non-networked app domain. Resolve this overlap by: 1) Adding the missing permissions allowed by app.te to net.te for netlink_route_socket and rawip_socket. 2) Adding net_domain() calls to all existing app domains that do not already have it. 3) Deleting the redundant socket rules from app.te. Then we'll have no effective change in what is allowed for apps but allow one to define app domains in the future that are not allowed network access. Also cleanup net.te to use the create_socket_perms macro rather than * and add macros for stream socket permissions. Change-Id: I6e80d65b0ccbd48bd2b7272c083a4473e2b588a9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 16:48:03 +01:00
# See changes to the routing table.
Further restrict socket ioctls available to apps (cherry picked from commit 6ba383c575985d56752e006d6e65ba7a49abd52e) Restrict unix_dgram_socket and unix_stream_socket to a whitelist. Disallow all ioctls for netlink_selinux_socket and netlink_route_socket. Neverallow third party app use of all ioctls other than unix_dgram_socket, unix_stream_socket, netlink_selinux_socket, netlink_route_socket, tcp_socket, udp_socket and rawip_socket. Bug: 28171804 Change-Id: Icfe3486a62fc2fc2d2abd8d4030a5fbdd0ab30ab
2016-04-15 19:54:40 +02:00
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append bind connect getopt setopt shutdown nlmsg_read };
Restore netdomain allow rules. Change I4be1c987a5d69ac784a56d42fc2c9063c402de11 removed all netdomain allow rules at the same time domains were made unconfined. Prior to that change, any domain that used the net_domain() macro would be granted permissions required to use the network via these rules. The change made the netdomain attribute unused in any rules, thereby rendering the net_domain() calls pointless and requiring the allow rules to be duplicated for any domain requiring network access. There are two ways to resolve this inconsistency: 1. Restore the netdomain rules as in this change. In that case, some rules in app.te can be removed as they are redundant with these rules. -or- 2. Completely remove the netdomain attribute, the net_domain() macro, and all calls to it. In that case, each domain that requires network access will need to duplicate these rules or the necessary subset in order to function. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Change-Id: Ia54f0cd0bbda5c510423b1046626bd50f79ed7b6
2013-09-30 21:07:55 +02:00
# Talks to netd via dnsproxyd socket.
unix_socket_connect(netdomain, dnsproxyd, netd)
Add a domain for mdnsd and allow connecting to it. Change-Id: I0a06fa32a46e515671b4e9a6f68e1a3f8b2c21a8 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 19:04:49 +01:00
Introduce fwmarkd: a service to set the fwmark of sockets. Change-Id: Ib6198e19dbc306521a26fcecfdf6e8424d163fc9
2014-05-01 20:12:10 +02:00
# Talks to netd via fwmarkd socket.
unix_socket_connect(netdomain, fwmarkd, netd)
Add a domain for mdnsd and allow connecting to it. Change-Id: I0a06fa32a46e515671b4e9a6f68e1a3f8b2c21a8 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 19:04:49 +01:00
# Connect to mdnsd via mdnsd socket.
unix_socket_connect(netdomain, mdnsd, mdnsd)
Reference in a new issue Copy permalink