diff --git a/access_vectors b/access_vectors index 320a1c8976880bd0a1c9374d06651fa7c0c68d30..43b81e9f42d682950d0a12fe2fdbaccba04e39e9 100644 --- a/access_vectors +++ b/access_vectors @@ -876,14 +876,6 @@ class binder transfer } -class zygote -{ - specifyids - specifyrlimits - specifyinvokewith - specifyseinfo -} - class property_service { set diff --git a/domain.te b/domain.te index d835ee940e59c9c32028c156e3d37f336f709b5b..b2eaa79057b07e0b23a7b5b2821052464003394c 100644 --- a/domain.te +++ b/domain.te @@ -344,6 +344,10 @@ neverallow { -dex2oat } dalvikcache_data_file:file no_w_file_perms; +# Only system_server should be able to send commands via the zygote socket +neverallow { domain -zygote -system_server } zygote:unix_stream_socket connectto; +neverallow { domain -system_server } zygote_socket:sock_file write; + # Android does not support System V IPCs. # # The reason for this is due to the fact that, by design, they lead to global diff --git a/system_server.te b/system_server.te index 82b4d73362c7c28a88dfc6f25c01f08487a769d2..517559684213c6f053310a295c134b98b233076d 100644 --- a/system_server.te +++ b/system_server.te @@ -300,9 +300,6 @@ allow system_server wpa_socket:sock_file unlink; type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket"; allow system_server system_ndebug_socket:sock_file create_file_perms; -# Specify any arguments to zygote. -allow system_server self:zygote { specifyids specifyrlimits specifyseinfo }; - # Manage cache files. allow system_server cache_file:dir { relabelfrom create_dir_perms }; allow system_server cache_file:file { relabelfrom create_file_perms };