PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

unconfined: remove internet access

Browse Source 
Don't allow unconfined domains to access the internet. Restrict
internet functionality to domains which explicitly declare their
use. Removing internet access from unconfined domains helps
protect daemons from network level attacks.

In unconfined.te, expand out socket_class_set, and explicitly remove
tcp_socket, udp_socket, rawip_socket, packet_socket, and
appletalk_socket. Remove name_bind, node_bind and name_connect rules,
since they only apply to internet accessible rules.

Add limited udp support to init.te. This is needed to bring up
the loopback interface at boot.

Change-Id: If756f3fed857f11e63a6c3a1a13263c57fdf930a
This commit is contained in:
Nick Kralevich 2014-06-20 21:15:56 -07:00
parent a893edae37
commit 0db95cce33
2 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
init.te
View File

@ -86,6 +86,9 @@ allow init self:process { setexec setfscreate setsockcreate };
allow init property_data_file:dir create_dir_perms;
allow init property_data_file:file create_file_perms;
# Run "ifup lo" to bring up the localhost interface
allow init self:udp_socket { create ioctl };
###
### neverallow rules
###

22
unconfined.te
View File

@ -45,7 +45,24 @@ allow unconfineddomain domain:fd *;
allow unconfineddomain domain:dir r_dir_perms;
allow unconfineddomain domain:lnk_file r_file_perms;
allow unconfineddomain domain:{ fifo_file file } rw_file_perms;
allow unconfineddomain domain:socket_class_set *;
allow unconfineddomain domain:{
socket
netlink_socket
key_socket
unix_stream_socket
unix_dgram_socket
netlink_route_socket
netlink_firewall_socket
netlink_tcpdiag_socket
netlink_nflog_socket
netlink_xfrm_socket
netlink_selinux_socket
netlink_audit_socket
netlink_ip6fw_socket
netlink_dnrt_socket
netlink_kobject_uevent_socket
tun_socket
} *;
allow unconfineddomain domain:ipc_class_set *;
allow unconfineddomain domain:key *;
allow unconfineddomain {fs_type -contextmount_type -sdcard_type}:{ dir lnk_file sock_file fifo_file } ~relabelto;
@ -89,10 +106,7 @@ allow unconfineddomain rootfs:file execute;
allow unconfineddomain contextmount_type:dir r_dir_perms;
allow unconfineddomain contextmount_type:notdevfile_class_set r_file_perms;
allow unconfineddomain node_type:node *;
allow unconfineddomain node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
allow unconfineddomain netif_type:netif *;
allow unconfineddomain port_type:socket_class_set name_bind;
allow unconfineddomain port_type:{ tcp_socket dccp_socket } name_connect;
allow unconfineddomain domain:peer recv;
allow unconfineddomain { domain -init }:binder { call transfer set_context_mgr };
allow unconfineddomain { property_type -security_prop }:property_service set;