tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

disallow unprivileged access to rmnet

Browse source 
Enforce via neverallow rule by adding WAN_IOC_ADD_FLT_RULE
and WAN_IOC_ADD_FLT_RULE_INDEX to neverallow macro.

Bug: 26324307
Change-Id: I5350d9339e45ddeefd5423c3fe9a0ea14fe877b2
This commit is contained in:
Jeff Vander Stoep 2016-01-05 08:01:53 -08:00 committed by Jeffrey Vander Stoep
parent e97bd887ca
commit 84a61cc535
2 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ioctl_defines
View file

@ -2631,3 +2631,5 @@ define(`BTRFS_IOC_INO_LOOKUP', `0xd0009412')
define(`BTRFS_IOC_DEV_INFO', `0xd000941e')
define(`HIDIOCGUSAGES', `0xd01c4813')
define(`SNDRV_COMPRESS_GET_CODEC_CAPS', `0xeb884311')
define(`WAN_IOC_ADD_FLT_RULE', `0x00006900')
define(`WAN_IOC_ADD_FLT_INDEX', `0x00006902')

2
ioctl_macros
View file

@ -15,6 +15,8 @@ TIOCOUTQ FIOCLEX
# socket ioctls never allowed to unprivileged apps
define(`priv_sock_ioctls', `
{
# qualcomm rmnet ioctls
WAN_IOC_ADD_FLT_RULE WAN_IOC_ADD_FLT_INDEX
# socket ioctls
SIOCADDRT SIOCDELRT SIOCRTMSG SIOCSIFLINK SIOCSIFFLAGS SIOCSIFADDR SIOCGIFDSTADDR
SIOCSIFDSTADDR SIOCSIFBRDADDR SIOCSIFNETMASK SIOCGIFMETRIC SIOCSIFMETRIC SIOCGIFMEM