tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Enforce MAC address restrictions for priv apps."

Browse source
This commit is contained in:
Bram Bonné 2022-05-18 12:33:53 +00:00 committed by Gerrit Code Review
commit 6b2fefbf46
2 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/app_neverallows.te
View file

@ -127,6 +127,7 @@ neverallow all_untrusted_apps *:vsock_socket ~{ getattr read write };
# Disallow sending RTM_GETLINK messages on netlink sockets. # Disallow sending RTM_GETLINK messages on netlink sockets.
neverallow all_untrusted_apps domain:netlink_route_socket { bind nlmsg_readpriv }; neverallow all_untrusted_apps domain:netlink_route_socket { bind nlmsg_readpriv };
neverallow priv_app domain:netlink_route_socket { bind nlmsg_readpriv };
# Disallow sending RTM_GETNEIGH{TBL} messages on netlink sockets. # Disallow sending RTM_GETNEIGH{TBL} messages on netlink sockets.
neverallow { neverallow {

1
private/net.te
View file

@ -12,6 +12,7 @@ allow {
netdomain netdomain
-ephemeral_app -ephemeral_app
-mediaprovider -mediaprovider
-priv_app
-sdk_sandbox -sdk_sandbox
-untrusted_app_all -untrusted_app_all
} self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh }; } self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh };