tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
41193 commits 1 branch 0 tags 50 MiB
Commit graph

6 commits

Author SHA1 Message Date
Yuyang Huang
cfdea5f4f3 Blocks untrusted apps to access /dev/socket/mdnsd from U 
The untrusted apps should not directly access /dev/socket/mdnsd since
API level 34 (U). Only adbd and netd should remain to have access to
/dev/socket/mdnsd. For untrusted apps running with API level 33-, they
still have access to /dev/socket/mdnsd for backward compatibility.

Bug: 265364111
Test: Manual test
Change-Id: Id37998fcb9379fda6917782b0eaee29cd3c51525
 2023-01-20 15:25:46 +09:00
Alessandra Loro
8a7dcb5e1e Drop back-compatibility for hiding ro.debuggable and ro.secure 
Bug: 193912100
Test: back-compatibility change for android.security.SELinuxTargetSdkTest
Change-Id: I47f2ddc4fa87bf6c8f872d2679348b2eecddcaad
 2022-08-18 13:43:17 +00:00
Alessandra Loro
d0e108fbbe Disallow untrusted apps to read ro.debuggable and ro.secure 
ro.secure and ro.debuggable system properties are not intended
to be visible via Android SDK. This change blocks untrusted
apps from reading these properties.

Test: android.security.SELinuxTargetSdkTest
Bug: 193912100
Change-Id: I40ac5d43da5778b5fa863b559c28e8d72961f831
 2022-08-16 14:24:27 +00:00
Bram Bonné
ea5460ab6e untrusted_app_30: add new targetSdk domain 
Enforce new requirements on app with targetSdkVersion=32 including:
- No RTM_GETNEIGH on netlink route sockets.
- No RTM_GETNEIGHTBL on netlink route sockets.

Bug: 171572148
Test: atest NetworkInterfaceTest
Test: atest bionic-unit-tests-static
Test: atest CtsSelinuxTargetSdkCurrentTestCases
Test: atest CtsSelinuxTargetSdk30TestCases
Test: atest CtsSelinuxTargetSdk29TestCases
Test: atest CtsSelinuxTargetSdk28TestCases
Test: atest CtsSelinuxTargetSdk27TestCases
Test: atest CompatChangesSelinuxTest
Test: atest NetlinkSocketTest
Change-Id: I2167e6cd564854c2656ee06c2202cfff2b727af5
 2021-07-05 11:42:31 +02:00
Paul Hobbs
f6fc9377ad Revert "untrusted_app_30: add new targetSdk domain" 
Revert "Ignore SELinux denials for all untrusted_app domains"

Revert "Update tests to check RTM_GETNEIGH{TBL} restrictions"

Revert submission 1748045-getneigh-enable-restrictions

Reason for revert: Breaks android.net.netlink.NetlinkSocketTest#testBasicWorkingGetNeighborsQuery with permissions error.

Bug: 192406650

Reverted Changes:
Iea29a1b36:Ignore SELinux denials for all untrusted_app domai...
I14b755020:Update tests to check RTM_GETNEIGH{TBL} restrictio...
I32ebb407b:untrusted_app_30: add new targetSdk domain
I8598662b7:libsepol: trigger new RTM_GETNEIGH{TBL} behavior

Change-Id: I525544191520607fdd238b5ac55aa5132f679253
 2021-06-30 07:41:39 +00:00
Bram Bonné
55badc22c1 untrusted_app_30: add new targetSdk domain 
Enforce new requirements on app with targetSdkVersion=32 including:
- No RTM_GETNEIGH on netlink route sockets.
- No RTM_GETNEIGHTBL on netlink route sockets.

Bug: 171572148
Test: atest NetworkInterfaceTest
Test: atest bionic-unit-tests-static
Test: atest CtsSelinuxTargetSdkCurrentTestCases

Change-Id: I32ebb407b8dde1c872f53a1bc3c1ec20b9a5cb49
 2021-06-29 17:50:22 +02:00