tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow More Apps to Recv UDP Sockets from SystemServer

Browse source 
am: ee268643c1

Change-Id: I69408d68b23c241e396e303f7b68f34c4f6fb832
This commit is contained in:
Nathan Harold 2018-01-16 02:42:56 +00:00 committed by android-build-merger
commit 0003e3d54c
7 changed files with 24 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
private/app.te
View file

@ -1,3 +1,7 @@
# TODO: deal with tmpfs_domain pub/priv split properly
# Read system properties managed by zygote.
allow appdomain zygote_tmpfs:file read;
neverallow appdomain system_server:udp_socket {
accept append bind create getopt ioctl listen lock name_bind
relabelfrom relabelto setattr setopt shutdown };

4
private/ephemeral_app.te
View file

@ -41,6 +41,10 @@ allow ephemeral_app traced:fd use;
allow ephemeral_app traced_tmpfs:file { read write getattr map };
unix_socket_connect(ephemeral_app, traced_producer, traced)
# allow ephemeral apps to use UDP sockets provided by the system server but not
# modify them other than to connect
allow ephemeral_app system_server:udp_socket { connect getattr read recvfrom sendto write };
###
### neverallow rules
###

4
private/platform_app.te
View file

@ -67,6 +67,10 @@ allow platform_app preloads_media_file:dir r_dir_perms;
read_runtime_log_tags(platform_app)
# allow platform apps to use UDP sockets provided by the system server but not
# modify them other than to connect
allow platform_app system_server:udp_socket { connect getattr read recvfrom sendto write };
###
### Neverallow rules
###

4
private/priv_app.te
View file

@ -128,6 +128,10 @@ dontaudit priv_app device:dir read;
dontaudit priv_app proc_interrupts:file read;
dontaudit priv_app proc_modules:file read;
# allow privileged apps to use UDP sockets provided by the system server but not
# modify them other than to connect
allow priv_app system_server:udp_socket { connect getattr read recvfrom sendto write };
###
### neverallow rules
###

4
private/system_app.te
View file

@ -114,6 +114,10 @@ allow system_app {
control_logd(system_app)
read_runtime_log_tags(system_app)
# allow system apps to use UDP sockets provided by the system server but not
# modify them other than to connect
allow system_app system_server:udp_socket { connect getattr read recvfrom sendto write };
###
### Neverallow rules
###

8
private/untrusted_app.te
View file

@ -24,14 +24,6 @@ untrusted_app_domain(untrusted_app)
net_domain(untrusted_app)
bluetooth_domain(untrusted_app)
# allow untrusted apps to use UDP sockets provided by the system server but not
# modify them other than to connect
allow untrusted_app system_server:udp_socket { connect getattr read recvfrom sendto write };
# Allow the allocation and use of ptys
# Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm
create_pty(untrusted_app)
neverallow untrusted_app system_server:udp_socket {
accept append bind create getopt ioctl listen lock name_bind
relabelfrom relabelto setattr setopt shutdown };

4
private/untrusted_app_all.te
View file

@ -111,3 +111,7 @@ allow untrusted_app_all vendor_app_file:lnk_file { open getattr read };
allow untrusted_app_all traced:fd use;
allow untrusted_app_all traced_tmpfs:file { read write getattr map };
unix_socket_connect(untrusted_app_all, traced_producer, traced)
# allow untrusted apps to use UDP sockets provided by the system server but not
# modify them other than to connect
allow untrusted_app_all system_server:udp_socket { connect getattr read recvfrom sendto write };