5c6a227ebb
Copy the final system sepolicy from oc-dev to its prebuilt dir corresponding to its version (26.0) so that we can uprev policy and start maintaining compatibility files, as well as use it for CTS tests targeting future platforms. Bug: 37896931 Test: none, this just copies the old policy. Change-Id: Ib069d505e42595c467e5d1164fb16fcb0286ab93
15 lines
681 B
Text
15 lines
681 B
Text
#
|
|
# Common neverallow permissions
|
|
define(`no_w_file_perms', `{ append create link unlink relabelfrom rename setattr write }')
|
|
define(`no_rw_file_perms', `{ no_w_file_perms open read ioctl lock }')
|
|
define(`no_x_file_perms', `{ execute execute_no_trans }')
|
|
define(`no_w_dir_perms', `{ add_name create link relabelfrom remove_name rename reparent rmdir setattr write }')
|
|
|
|
#####################################
|
|
# neverallow_establish_socket_comms(src, dst)
|
|
# neverallow src domain establishing socket connections to dst domain.
|
|
#
|
|
define(`neverallow_establish_socket_comms', `
|
|
neverallow $1 $2:socket_class_set { connect sendto };
|
|
neverallow $1 $2:unix_stream_socket connectto;
|
|
')
|