tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
6038 commits 1 branch 0 tags 50 MiB
Commit graph

7 commits

Author SHA1 Message Date
Jeff Vander Stoep
c4a93a6cdd add SIOCGIFINDEX to list of unprivileged socket ioctls 
Addresses
avc: denied { ioctl } for path="socket:[69748]" dev="sockfs" ino=69748
ioctlcmd=8933 scontext=u:r:untrusted_app:s0:c512,c768
tcontext=u:r:untrusted_app:s0:c512,c768 tclass=udp_socket

Change-Id: Iee3821ade9dc044fa03705902923ed18c91425dd
 2016-01-08 13:41:05 -08:00
Jeff Vander Stoep
84a61cc535 disallow unprivileged access to rmnet 
Enforce via neverallow rule by adding WAN_IOC_ADD_FLT_RULE
and WAN_IOC_ADD_FLT_RULE_INDEX to neverallow macro.

Bug: 26324307
Change-Id: I5350d9339e45ddeefd5423c3fe9a0ea14fe877b2
 2016-01-05 16:45:55 +00:00
Jeff Vander Stoep
cbaa2b7d37 Reduce socket ioctl perms 
Reduce the socket ioctl commands available to untrusted/isolated apps.
Neverallow accessing sensitive information or setting of network parameters.
Neverallow access to device private ioctls i.e. device specific
customizations as these are a common source of driver bugs.

Define common ioctl commands in ioctl_defines.

Bug: 26267358
Change-Id: Ic5c0af066e26d4cb2867568f53a3e65c5e3b5a5d
 2016-01-04 12:15:19 -08:00
Jeff Vander Stoep
3a0ce49b86 Migrate to upstream policy version 30 
Grant untrusted_app and isolated_app unpriv_sock_perms, neverallow
priv_sock_perms to disallow access to MAC address and ESSID.

Change-Id: Idac3b657a153e7d7fdc647ff34b876a325d759b3
 2015-12-11 18:07:17 +00:00
Jeffrey Vander Stoep
4f9107df8f Revert "Migrate to upstream policy version 30" 
This reverts commit 2ea23a6e1a.

Change-Id: I5e9efa56d74ab22030611cab515e050e0bb77aca
 2015-12-08 12:14:50 -08:00
Jeff Vander Stoep
2ea23a6e1a Migrate to upstream policy version 30 
Grant untrusted_app and isolated_app unpriv_sock_perms, neverallow
priv_sock_perms to disallow access to MAC address and ESSID.

Change-Id: Idac3b657a153e7d7fdc647ff34b876a325d759b3
 2015-12-08 07:18:41 -08:00
Jeff Vander Stoep
de9b5301a1 restrict app access to socket ioctls 
Create a macro of unprivileged ioctls including
- All common socket ioctls except MAC address
- All wireless extensions ioctls except get/set ESSID
- Some commonly used tty ioctls

Bug: 21657002
Change-Id: Ib08be9cb70d08c1fa2c8bddbae519e7c2df5293c
 2015-06-05 22:35:51 +00:00