From 0db95cce33b33259e87b41c7fa1807f562c2d7d1 Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Fri, 20 Jun 2014 21:15:56 -0700
Subject: [PATCH] unconfined: remove internet access
Don't allow unconfined domains to access the internet. Restrict
internet functionality to domains which explicitly declare their
use. Removing internet access from unconfined domains helps
protect daemons from network level attacks.
In unconfined.te, expand out socket_class_set, and explicitly remove
tcp_socket, udp_socket, rawip_socket, packet_socket, and
appletalk_socket. Remove name_bind, node_bind and name_connect rules,
since they only apply to internet accessible rules.
Add limited udp support to init.te. This is needed to bring up
the loopback interface at boot.
Change-Id: If756f3fed857f11e63a6c3a1a13263c57fdf930a
---
init.te | 3 +++
unconfined.te | 22 ++++++++++++++++++----
2 files changed, 21 insertions(+), 4 deletions(-)
diff --git a/init.te b/init.te
index 2c00cb484..c781849e5 100644
--- a/init.te
+++ b/init.te
@@ -86,6 +86,9 @@ allow init self:process { setexec setfscreate setsockcreate };
allow init property_data_file:dir create_dir_perms;
allow init property_data_file:file create_file_perms;
+# Run "ifup lo" to bring up the localhost interface
+allow init self:udp_socket { create ioctl };
+
###
### neverallow rules
###
diff --git a/unconfined.te b/unconfined.te
index d74b29303..b3e374dc1 100644
--- a/unconfined.te
+++ b/unconfined.te
@@ -45,7 +45,24 @@ allow unconfineddomain domain:fd *;
allow unconfineddomain domain:dir r_dir_perms;
allow unconfineddomain domain:lnk_file r_file_perms;
allow unconfineddomain domain:{ fifo_file file } rw_file_perms;
-allow unconfineddomain domain:socket_class_set *;
+allow unconfineddomain domain:{
+ socket
+ netlink_socket
+ key_socket
+ unix_stream_socket
+ unix_dgram_socket
+ netlink_route_socket
+ netlink_firewall_socket
+ netlink_tcpdiag_socket
+ netlink_nflog_socket
+ netlink_xfrm_socket
+ netlink_selinux_socket
+ netlink_audit_socket
+ netlink_ip6fw_socket
+ netlink_dnrt_socket
+ netlink_kobject_uevent_socket
+ tun_socket
+} *;
allow unconfineddomain domain:ipc_class_set *;
allow unconfineddomain domain:key *;
allow unconfineddomain {fs_type -contextmount_type -sdcard_type}:{ dir lnk_file sock_file fifo_file } ~relabelto;
@@ -89,10 +106,7 @@ allow unconfineddomain rootfs:file execute;
allow unconfineddomain contextmount_type:dir r_dir_perms;
allow unconfineddomain contextmount_type:notdevfile_class_set r_file_perms;
allow unconfineddomain node_type:node *;
-allow unconfineddomain node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
allow unconfineddomain netif_type:netif *;
-allow unconfineddomain port_type:socket_class_set name_bind;
-allow unconfineddomain port_type:{ tcp_socket dccp_socket } name_connect;
allow unconfineddomain domain:peer recv;
allow unconfineddomain { domain -init }:binder { call transfer set_context_mgr };
allow unconfineddomain { property_type -security_prop }:property_service set;
--
GitLab