PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "buildtime/cts enforce no inet access for media domains" into nyc-dev

Browse Source
This commit is contained in:
Jeffrey Vander Stoep 2016-04-22 22:44:53 +00:00 committed by Android (Google) Code Review
commit 959b03603c
4 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
audioserver.te
View File

@ -51,3 +51,5 @@ unix_socket_connect(audioserver, bluetooth, bluetooth)
# domain transition
neverallow audioserver { file_type fs_type }:file execute_no_trans;
# audioserver should never need network access. Disallow network sockets.
neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *;

3
cameraserver.te
View File

@ -34,3 +34,6 @@ allow cameraserver surfaceflinger_service:service_manager find;
# cameraserver should never execute any executable without a
# domain transition
neverallow cameraserver { file_type fs_type }:file execute_no_trans;
# cameraserver should never need network access. Disallow network sockets.
neverallow cameraserver domain:{ tcp_socket udp_socket rawip_socket } *;

5
mediacodec.te
View File

@ -26,6 +26,5 @@ allow mediacodec ion_device:chr_file rw_file_perms;
# domain transition
neverallow mediacodec { file_type fs_type }:file execute_no_trans;
# mediacodec should never need network access. Disallow all sockets
# other than those needed for normal system functions
neverallow mediacodec { domain -debuggerd -dumpstate -adbd -mediacodec -logd userdebug_or_eng(`-su')}:socket_class_set *;
# mediacodec should never need network access. Disallow network sockets.
neverallow mediacodec domain:{ tcp_socket udp_socket rawip_socket } *;

5
mediaextractor.te
View File

@ -21,6 +21,5 @@ allow mediaextractor mediaextractor_service:service_manager add;
# domain transition
neverallow mediaextractor { file_type fs_type }:file execute_no_trans;
# mediaextractor should never need network access. Disallow all sockets
# other than those needed for normal system functions
neverallow mediaextractor { domain -debuggerd -dumpstate -adbd -mediaextractor -logd userdebug_or_eng(`-su')}:socket_class_set *;
# mediaextractor should never need network access. Disallow network sockets.
neverallow mediaextractor domain:{ tcp_socket udp_socket rawip_socket } *;