platform_system_sepolicy/private/net.te

###
### Domain with network access
###

# Use network sockets.
allow netdomain self:tcp_socket create_stream_socket_perms;
allow netdomain self:{ icmp_socket udp_socket rawip_socket } create_socket_perms;

# Connect to ports.
allow netdomain port_type:tcp_socket name_connect;
# Bind to ports.
allow {netdomain -ephemeral_app} node_type:{ tcp_socket udp_socket } node_bind;
allow {netdomain -ephemeral_app} port_type:udp_socket name_bind;
allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind;
# See changes to the routing table.
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append bind connect getopt setopt shutdown nlmsg_read };

# Talks to netd via dnsproxyd socket.
unix_socket_connect(netdomain, dnsproxyd, netd)

# Talks to netd via fwmarkd socket.
unix_socket_connect(netdomain, fwmarkd, netd)

# Connect to mdnsd via mdnsd socket.
unix_socket_connect(netdomain, mdnsd, mdnsd)
Move netdomain policy to private This leaves only the existence of netdomain attribute as public API. All other rules are implementation details of this attribute's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with netdomain_current and *_current attributes targeted when netdomain rules reference public types. Bug: 31364497 Change-Id: I102e649374681ce1dd9e1e5ccbaaa5cb754e00a0 2017-02-06 22:26:42 +01:00			`###`
			`### Domain with network access`
			`###`

			`# Use network sockets.`
			`allow netdomain self:tcp_socket create_stream_socket_perms;`
Update socket ioctl restrictions Grant access to icmp_socket to netdomain. This was previously labeled as rawip_socket which apps are allowed to use. Neverallow all other new socket types for apps. Kernels versions > 4.9 redefine ICMP sockets from rawip_socket to icmp_socket. To pass neverallow tests, we need to define which IOCTLs are allowed (and disallowed). Note that this does not change behavior on devices with kernel versions <=4.9. However, it is necessary (although not sufficient) to pass CTS on kernel version 4.14. Bug: 110520616 Test: Grant icmp_socket in net.te and build. Change-Id: I5c7cb6867d1a4cd1554a8da0d55daa8e06daf803 2018-06-22 01:57:58 +02:00			`allow netdomain self:{ icmp_socket udp_socket rawip_socket } create_socket_perms;`

Move netdomain policy to private This leaves only the existence of netdomain attribute as public API. All other rules are implementation details of this attribute's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with netdomain_current and *_current attributes targeted when netdomain rules reference public types. Bug: 31364497 Change-Id: I102e649374681ce1dd9e1e5ccbaaa5cb754e00a0 2017-02-06 22:26:42 +01:00			`# Connect to ports.`
			`allow netdomain port_type:tcp_socket name_connect;`
			`# Bind to ports.`
			`allow {netdomain -ephemeral_app} node_type:{ tcp_socket udp_socket } node_bind;`
			`allow {netdomain -ephemeral_app} port_type:udp_socket name_bind;`
			`allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind;`
			`# See changes to the routing table.`
			`allow netdomain self:netlink_route_socket { create read getattr write setattr lock append bind connect getopt setopt shutdown nlmsg_read };`

			`# Talks to netd via dnsproxyd socket.`
			`unix_socket_connect(netdomain, dnsproxyd, netd)`

			`# Talks to netd via fwmarkd socket.`
			`unix_socket_connect(netdomain, fwmarkd, netd)`

			`# Connect to mdnsd via mdnsd socket.`
			`unix_socket_connect(netdomain, mdnsd, mdnsd)`