Skip to content
Snippets Groups Projects
  • Jeff Vander Stoep's avatar
    32333536
    Further restrict socket ioctls available to apps · 32333536
    Jeff Vander Stoep authored
    (cherry picked from commit 6ba383c5)
    
    Restrict unix_dgram_socket and unix_stream_socket to a whitelist.
    Disallow all ioctls for netlink_selinux_socket and netlink_route_socket.
    
    Neverallow third party app use of all ioctls other than
    unix_dgram_socket, unix_stream_socket, netlink_selinux_socket,
    netlink_route_socket, tcp_socket, udp_socket and rawip_socket.
    
    Bug: 28171804
    Change-Id: Icfe3486a62fc2fc2d2abd8d4030a5fbdd0ab30ab
    32333536
    History
    Further restrict socket ioctls available to apps
    Jeff Vander Stoep authored
    (cherry picked from commit 6ba383c5)
    
    Restrict unix_dgram_socket and unix_stream_socket to a whitelist.
    Disallow all ioctls for netlink_selinux_socket and netlink_route_socket.
    
    Neverallow third party app use of all ioctls other than
    unix_dgram_socket, unix_stream_socket, netlink_selinux_socket,
    netlink_route_socket, tcp_socket, udp_socket and rawip_socket.
    
    Bug: 28171804
    Change-Id: Icfe3486a62fc2fc2d2abd8d4030a5fbdd0ab30ab