tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Fix system server and network stack netlink permissions" am: 817d82bcf5

Browse source 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2101773

Change-Id: I50174efca8b92bc399bbddb7e1418cbca037d5dd
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Patrick Rohr 2022-05-27 01:57:58 +00:00 committed by Automerger Merge Worker
commit 3684e7af8f
3 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
private/network_stack.te
View file

@ -22,6 +22,14 @@ allow network_stack self:packet_socket create_socket_perms_no_ioctl;
# Monitor neighbors via netlink.
allow network_stack self:netlink_route_socket nlmsg_write;
# Use netlink uevent sockets.
allow network_stack self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
# give network_stack the same netlink permissions as netd
allow network_stack self:netlink_nflog_socket create_socket_perms_no_ioctl;
allow network_stack self:netlink_socket create_socket_perms_no_ioctl;
allow network_stack self:netlink_generic_socket create_socket_perms_no_ioctl;
allow network_stack app_api_service:service_manager find;
allow network_stack dnsresolver_service:service_manager find;
allow network_stack mdns_service:service_manager find;

5
private/system_server.te
View file

@ -159,11 +159,14 @@ allow system_server self:global_capability2_class_set wake_alarm;
allow system_server self:netlink_netfilter_socket create_socket_perms_no_ioctl;
# Create/use netlink_tcpdiag_socket for looking up connection UIDs for VPN apps.
allow system_server self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read };
allow system_server self:netlink_tcpdiag_socket
{ create_socket_perms_no_ioctl nlmsg_read nlmsg_write };
# Use netlink uevent sockets.
allow system_server self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
allow system_server self:netlink_nflog_socket create_socket_perms_no_ioctl;
# Use generic netlink sockets.
allow system_server self:netlink_socket create_socket_perms_no_ioctl;
allow system_server self:netlink_generic_socket create_socket_perms_no_ioctl;

3
public/app.te
View file

@ -53,7 +53,8 @@ neverallow { appdomain -network_stack }
# These messages are broadcast messages from the kernel to userspace.
# Do not allow the writing of netlink messages, which has been a source
# of rooting vulns in the past.
neverallow appdomain domain:netlink_kobject_uevent_socket { write append };
neverallow { appdomain -network_stack }
domain:netlink_kobject_uevent_socket { write append };
# Sockets under /dev/socket that are not specifically typed.
neverallow appdomain socket_device:sock_file write;