tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Further restrict access to tun_device"

Browse source 
am: 98c3f9971f

* commit '98c3f9971f4b551fd5578c63f77fa9111bed94ad':
  Further restrict access to tun_device
This commit is contained in:
Jeffrey Vander Stoep 2015-12-04 01:38:37 +00:00 committed by android-build-merger
commit cd47828c12
3 changed files with 4 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
app.te
View file

@ -396,3 +396,6 @@ neverallow appdomain {
security_file security_file
tmpfs tmpfs
}:lnk_file no_w_file_perms; }:lnk_file no_w_file_perms;
# Do not allow Apps to directly open tun_device
neverallow appdomain tun_device:chr_file open;

7
bluetooth.te
View file

@ -16,12 +16,7 @@ allow bluetooth bluetooth_socket:sock_file create_file_perms;
# bluetooth factory file accesses. # bluetooth factory file accesses.
r_dir_file(bluetooth, bluetooth_efs_file) r_dir_file(bluetooth, bluetooth_efs_file)
# TODO why does bluetooth require access to tun_device? If not, allow bluetooth { uhid_device hci_attach_dev }:chr_file rw_file_perms;
# remove access and tighten down neverallow rule so that appdomain is
# not allowed to open (as opposed to just untrusted_app)
# Device accesses. b/24744295
allow bluetooth { tun_device uhid_device hci_attach_dev }:chr_file rw_file_perms;
auditallow bluetooth tun_device:chr_file rw_file_perms;
# sysfs access. # sysfs access.
allow bluetooth sysfs_bluetooth_writable:file rw_file_perms; allow bluetooth sysfs_bluetooth_writable:file rw_file_perms;

3
untrusted_app.te
View file

@ -146,9 +146,6 @@ neverallow untrusted_app file_type:file link;
# Do not allow untrusted_app to access network MAC address file # Do not allow untrusted_app to access network MAC address file
neverallow untrusted_app sysfs_mac_address:file no_rw_file_perms; neverallow untrusted_app sysfs_mac_address:file no_rw_file_perms;
# Do not allow untrusted app to directly open tun_device
neverallow untrusted_app tun_device:chr_file open;
# Do not allow untrusted_app access to /cache # Do not allow untrusted_app access to /cache
neverallow untrusted_app cache_file:dir ~{ r_dir_perms }; neverallow untrusted_app cache_file:dir ~{ r_dir_perms };
neverallow untrusted_app cache_file:file ~{ read getattr }; neverallow untrusted_app cache_file:file ~{ read getattr };