1601132086
Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
22 lines
769 B
Text
22 lines
769 B
Text
# Network types
|
|
type node, node_type;
|
|
type netif, netif_type;
|
|
type port, port_type;
|
|
|
|
# Use network sockets.
|
|
allow netdomain self:tcp_socket create_stream_socket_perms;
|
|
allow netdomain self:{ udp_socket rawip_socket } create_socket_perms;
|
|
# Connect to ports.
|
|
allow netdomain port_type:tcp_socket name_connect;
|
|
# Bind to ports.
|
|
allow netdomain node_type:{ tcp_socket udp_socket } node_bind;
|
|
allow netdomain port_type:udp_socket name_bind;
|
|
allow netdomain port_type:tcp_socket name_bind;
|
|
# See changes to the routing table.
|
|
allow netdomain self:netlink_route_socket { create_socket_perms nlmsg_read };
|
|
|
|
# Talks to netd via dnsproxyd socket.
|
|
unix_socket_connect(netdomain, dnsproxyd, netd)
|
|
|
|
# Connect to mdnsd via mdnsd socket.
|
|
unix_socket_connect(netdomain, mdnsd, mdnsd)
|