tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/ioctl_macros

49 lines
2.3 KiB
Text
Raw Normal View History

restrict app access to socket ioctls Create a macro of unprivileged ioctls including - All common socket ioctls except MAC address - All wireless extensions ioctls except get/set ESSID - Some commonly used tty ioctls Bug: 21657002 Change-Id: Ib08be9cb70d08c1fa2c8bddbae519e7c2df5293c
2015-06-06 00:28:55 +02:00
# socket ioctls allowed to unprivileged apps
define(`unpriv_sock_ioctls', `
{
Reduce socket ioctl perms Reduce the socket ioctl commands available to untrusted/isolated apps. Neverallow accessing sensitive information or setting of network parameters. Neverallow access to device private ioctls i.e. device specific customizations as these are a common source of driver bugs. Define common ioctl commands in ioctl_defines. Bug: 26267358 Change-Id: Ic5c0af066e26d4cb2867568f53a3e65c5e3b5a5d
2015-12-22 19:39:34 +01:00
# Socket ioctls for gathering information about the interface
Add SIOCGSTAMP SIOCGSTAMPNS to unpriv_sock_ioctls Per "man socket": SIOCGSTAMP Return a struct timeval with the receive timestamp of the last packet passed to the user. This is useful for accurate round trip time measurements. See setitimer(2) for a description of struct timeval. This ioctl should only be used if the socket option SO_TIMESTAMP is not set on the socket. Otherwise, it returns the timestamp of the last packet that was received while SO_TIMESTAMP was not set, or it fails if no such packet has been received, (i.e., ioctl(2) returns -1 with errno set to ENOENT). Addresses the following denial: avc: denied { ioctl } for comm=6E6574776F726B5F74687265616420 path="socket:[42934]" dev="sockfs" ino=42934 ioctlcmd=8906 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:r:untrusted_app:s0:c512,c768 tclass=udp_socket permissive=0 Bug: 29333189 Change-Id: I916a695fa362cf1cf6759629c7f6101e9f657e7d
2016-06-14 12:57:02 +02:00
SIOCGSTAMP SIOCGSTAMPNS
define SIOCGIFDSTADDR as unprivileged ioctl Move from privileged macro to unprivileged. Bug: 28164785 Change-Id: Ide39dc0009871c209249a41e574e84009ac47380
2016-04-13 19:09:11 +02:00
SIOCGIFNAME SIOCGIFCONF SIOCGIFFLAGS SIOCGIFADDR SIOCGIFDSTADDR SIOCGIFBRDADDR
add SIOCGIFINDEX to list of unprivileged socket ioctls Addresses avc: denied { ioctl } for path="socket:[69748]" dev="sockfs" ino=69748 ioctlcmd=8933 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:r:untrusted_app:s0:c512,c768 tclass=udp_socket Change-Id: Iee3821ade9dc044fa03705902923ed18c91425dd
2016-01-08 22:37:53 +01:00
SIOCGIFNETMASK SIOCGIFMTU SIOCGIFINDEX SIOCGIFCOUNT SIOCGIFTXQLEN
Reduce socket ioctl perms Reduce the socket ioctl commands available to untrusted/isolated apps. Neverallow accessing sensitive information or setting of network parameters. Neverallow access to device private ioctls i.e. device specific customizations as these are a common source of driver bugs. Define common ioctl commands in ioctl_defines. Bug: 26267358 Change-Id: Ic5c0af066e26d4cb2867568f53a3e65c5e3b5a5d
2015-12-22 19:39:34 +01:00
# Wireless extension ioctls. Primarily get functions.
SIOCGIWNAME SIOCGIWFREQ SIOCGIWMODE SIOCGIWSENS SIOCGIWRANGE SIOCGIWPRIV
SIOCGIWSTATS SIOCGIWSPY SIOCSIWTHRSPY SIOCGIWTHRSPY SIOCGIWRATE SIOCGIWRTS
SIOCGIWFRAG SIOCGIWTXPOW SIOCGIWRETRY SIOCGIWPOWER
restrict app access to socket ioctls Create a macro of unprivileged ioctls including - All common socket ioctls except MAC address - All wireless extensions ioctls except get/set ESSID - Some commonly used tty ioctls Bug: 21657002 Change-Id: Ib08be9cb70d08c1fa2c8bddbae519e7c2df5293c
2015-06-06 00:28:55 +02:00
}')
Migrate to upstream policy version 30 Grant untrusted_app and isolated_app unpriv_sock_perms, neverallow priv_sock_perms to disallow access to MAC address and ESSID. Change-Id: Idac3b657a153e7d7fdc647ff34b876a325d759b3
2015-12-07 17:30:43 +01:00
Reduce socket ioctl perms Reduce the socket ioctl commands available to untrusted/isolated apps. Neverallow accessing sensitive information or setting of network parameters. Neverallow access to device private ioctls i.e. device specific customizations as these are a common source of driver bugs. Define common ioctl commands in ioctl_defines. Bug: 26267358 Change-Id: Ic5c0af066e26d4cb2867568f53a3e65c5e3b5a5d
2015-12-22 19:39:34 +01:00
# socket ioctls never allowed to unprivileged apps
Migrate to upstream policy version 30 Grant untrusted_app and isolated_app unpriv_sock_perms, neverallow priv_sock_perms to disallow access to MAC address and ESSID. Change-Id: Idac3b657a153e7d7fdc647ff34b876a325d759b3
2015-12-07 17:30:43 +01:00
define(`priv_sock_ioctls', `
{
disallow unprivileged access to rmnet Enforce via neverallow rule by adding WAN_IOC_ADD_FLT_RULE and WAN_IOC_ADD_FLT_RULE_INDEX to neverallow macro. Bug: 26324307 Change-Id: I5350d9339e45ddeefd5423c3fe9a0ea14fe877b2
2016-01-05 17:01:53 +01:00
# qualcomm rmnet ioctls
WAN_IOC_ADD_FLT_RULE WAN_IOC_ADD_FLT_INDEX
Reduce socket ioctl perms Reduce the socket ioctl commands available to untrusted/isolated apps. Neverallow accessing sensitive information or setting of network parameters. Neverallow access to device private ioctls i.e. device specific customizations as these are a common source of driver bugs. Define common ioctl commands in ioctl_defines. Bug: 26267358 Change-Id: Ic5c0af066e26d4cb2867568f53a3e65c5e3b5a5d
2015-12-22 19:39:34 +01:00
# socket ioctls
define SIOCGIFDSTADDR as unprivileged ioctl Move from privileged macro to unprivileged. Bug: 28164785 Change-Id: Ide39dc0009871c209249a41e574e84009ac47380
2016-04-13 19:09:11 +02:00
SIOCADDRT SIOCDELRT SIOCRTMSG SIOCSIFLINK SIOCSIFFLAGS SIOCSIFADDR
Reduce socket ioctl perms Reduce the socket ioctl commands available to untrusted/isolated apps. Neverallow accessing sensitive information or setting of network parameters. Neverallow access to device private ioctls i.e. device specific customizations as these are a common source of driver bugs. Define common ioctl commands in ioctl_defines. Bug: 26267358 Change-Id: Ic5c0af066e26d4cb2867568f53a3e65c5e3b5a5d
2015-12-22 19:39:34 +01:00
SIOCSIFDSTADDR SIOCSIFBRDADDR SIOCSIFNETMASK SIOCGIFMETRIC SIOCSIFMETRIC SIOCGIFMEM
SIOCSIFMEM SIOCSIFMTU SIOCSIFNAME SIOCSIFHWADDR SIOCGIFENCAP SIOCSIFENCAP
add SIOCGIFINDEX to list of unprivileged socket ioctls Addresses avc: denied { ioctl } for path="socket:[69748]" dev="sockfs" ino=69748 ioctlcmd=8933 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:r:untrusted_app:s0:c512,c768 tclass=udp_socket Change-Id: Iee3821ade9dc044fa03705902923ed18c91425dd
2016-01-08 22:37:53 +01:00
SIOCGIFHWADDR SIOCGIFSLAVE SIOCSIFSLAVE SIOCADDMULTI SIOCDELMULTI
Reduce socket ioctl perms Reduce the socket ioctl commands available to untrusted/isolated apps. Neverallow accessing sensitive information or setting of network parameters. Neverallow access to device private ioctls i.e. device specific customizations as these are a common source of driver bugs. Define common ioctl commands in ioctl_defines. Bug: 26267358 Change-Id: Ic5c0af066e26d4cb2867568f53a3e65c5e3b5a5d
2015-12-22 19:39:34 +01:00
SIOCSIFPFLAGS SIOCGIFPFLAGS SIOCDIFADDR SIOCSIFHWBROADCAST SIOCGIFBR SIOCSIFBR
SIOCSIFTXQLEN SIOCETHTOOL SIOCGMIIPHY SIOCGMIIREG SIOCSMIIREG SIOCWANDEV
SIOCOUTQNSD SIOCDARP SIOCGARP SIOCSARP SIOCDRARP SIOCGRARP SIOCSRARP SIOCGIFMAP
SIOCSIFMAP SIOCADDDLCI SIOCDELDLCI SIOCGIFVLAN SIOCSIFVLAN SIOCBONDENSLAVE
SIOCBONDRELEASE SIOCBONDSETHWADDR SIOCBONDSLAVEINFOQUERY SIOCBONDINFOQUERY
SIOCBONDCHANGEACTIVE SIOCBRADDBR SIOCBRDELBR SIOCBRADDIF SIOCBRDELIF SIOCSHWTSTAMP
# device and protocol specific ioctls
SIOCDEVPRIVATE-SIOCDEVPRIVLAST
SIOCPROTOPRIVATE-SIOCPROTOPRIVLAST
# Wireless extension ioctls
SIOCSIWCOMMIT SIOCSIWNWID SIOCSIWFREQ SIOCSIWMODE SIOCSIWSENS SIOCSIWRANGE
SIOCSIWPRIV SIOCSIWSTATS SIOCSIWSPY SIOCSIWAP SIOCGIWAP SIOCSIWMLME SIOCGIWAPLIST
SIOCSIWSCAN SIOCGIWSCAN SIOCSIWESSID SIOCGIWESSID SIOCSIWNICKN SIOCGIWNICKN
SIOCSIWRATE SIOCSIWRTS SIOCSIWFRAG SIOCSIWTXPOW SIOCSIWRETRY SIOCSIWENCODE
SIOCGIWENCODE SIOCSIWPOWER SIOCSIWGENIE SIOCGIWGENIE SIOCSIWAUTH SIOCGIWAUTH
SIOCSIWENCODEEXT SIOCGIWENCODEEXT SIOCSIWPMKSA
# Dev private ioctl i.e. hardware specific ioctls
SIOCIWFIRSTPRIV-SIOCIWLASTPRIV
Migrate to upstream policy version 30 Grant untrusted_app and isolated_app unpriv_sock_perms, neverallow priv_sock_perms to disallow access to MAC address and ESSID. Change-Id: Idac3b657a153e7d7fdc647ff34b876a325d759b3
2015-12-07 17:30:43 +01:00
}')
ioctls: move commonly used tty ioctls to macro Remove from unpriv_socket_ioctls but grant each user of unpriv_socket_ioctls use of unpriv_tty_ioctls Bug: 26990688 Change-Id: I998e09091de5a7234ad0049758d5dad0b35722f7
2016-02-22 21:31:57 +01:00
Further restrict socket ioctls available to apps (cherry picked from commit 6ba383c575985d56752e006d6e65ba7a49abd52e) Restrict unix_dgram_socket and unix_stream_socket to a whitelist. Disallow all ioctls for netlink_selinux_socket and netlink_route_socket. Neverallow third party app use of all ioctls other than unix_dgram_socket, unix_stream_socket, netlink_selinux_socket, netlink_route_socket, tcp_socket, udp_socket and rawip_socket. Bug: 28171804 Change-Id: Icfe3486a62fc2fc2d2abd8d4030a5fbdd0ab30ab
2016-04-15 19:54:40 +02:00
# commonly used ioctls on unix sockets
Whitelist additional unix socket ioctl TIOCGWINSZ = 0x00005413 avc: denied { ioctl } for comm="ls" path="socket:[362628]" dev="sockfs" ino=362628 ioctlcmd=5413 scontext=u:r:shell:s0 tcontext=u:r:adbd:s0 tclass=unix_stream_socket permissive=0 Bug: 28171804 Change-Id: I460e2469730d0cd90d714f30803ef849317d4be7
2016-04-26 19:21:51 +02:00
define(`unpriv_unix_sock_ioctls', `{TIOCOUTQ FIOCLEX TCGETS TIOCGWINSZ TIOCSWINSZ FIONREAD }')
Further restrict socket ioctls available to apps (cherry picked from commit 6ba383c575985d56752e006d6e65ba7a49abd52e) Restrict unix_dgram_socket and unix_stream_socket to a whitelist. Disallow all ioctls for netlink_selinux_socket and netlink_route_socket. Neverallow third party app use of all ioctls other than unix_dgram_socket, unix_stream_socket, netlink_selinux_socket, netlink_route_socket, tcp_socket, udp_socket and rawip_socket. Bug: 28171804 Change-Id: Icfe3486a62fc2fc2d2abd8d4030a5fbdd0ab30ab
2016-04-15 19:54:40 +02:00
ioctls: move commonly used tty ioctls to macro Remove from unpriv_socket_ioctls but grant each user of unpriv_socket_ioctls use of unpriv_tty_ioctls Bug: 26990688 Change-Id: I998e09091de5a7234ad0049758d5dad0b35722f7
2016-02-22 21:31:57 +01:00
# commonly used TTY ioctls
define(`unpriv_tty_ioctls', `{ TIOCOUTQ FIOCLEX }')
Reference in a new issue Copy permalink