Skip to content
Snippets Groups Projects
Commit 959b0360 authored by Jeffrey Vander Stoep's avatar Jeffrey Vander Stoep Committed by Android (Google) Code Review
Browse files

Merge "buildtime/cts enforce no inet access for media domains" into nyc-dev

parents 8785a647 21f77f63
No related merge requests found
...@@ -51,3 +51,5 @@ unix_socket_connect(audioserver, bluetooth, bluetooth) ...@@ -51,3 +51,5 @@ unix_socket_connect(audioserver, bluetooth, bluetooth)
# domain transition # domain transition
neverallow audioserver { file_type fs_type }:file execute_no_trans; neverallow audioserver { file_type fs_type }:file execute_no_trans;
# audioserver should never need network access. Disallow network sockets.
neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *;
...@@ -34,3 +34,6 @@ allow cameraserver surfaceflinger_service:service_manager find; ...@@ -34,3 +34,6 @@ allow cameraserver surfaceflinger_service:service_manager find;
# cameraserver should never execute any executable without a # cameraserver should never execute any executable without a
# domain transition # domain transition
neverallow cameraserver { file_type fs_type }:file execute_no_trans; neverallow cameraserver { file_type fs_type }:file execute_no_trans;
# cameraserver should never need network access. Disallow network sockets.
neverallow cameraserver domain:{ tcp_socket udp_socket rawip_socket } *;
...@@ -26,6 +26,5 @@ allow mediacodec ion_device:chr_file rw_file_perms; ...@@ -26,6 +26,5 @@ allow mediacodec ion_device:chr_file rw_file_perms;
# domain transition # domain transition
neverallow mediacodec { file_type fs_type }:file execute_no_trans; neverallow mediacodec { file_type fs_type }:file execute_no_trans;
# mediacodec should never need network access. Disallow all sockets # mediacodec should never need network access. Disallow network sockets.
# other than those needed for normal system functions neverallow mediacodec domain:{ tcp_socket udp_socket rawip_socket } *;
neverallow mediacodec { domain -debuggerd -dumpstate -adbd -mediacodec -logd userdebug_or_eng(`-su')}:socket_class_set *;
...@@ -21,6 +21,5 @@ allow mediaextractor mediaextractor_service:service_manager add; ...@@ -21,6 +21,5 @@ allow mediaextractor mediaextractor_service:service_manager add;
# domain transition # domain transition
neverallow mediaextractor { file_type fs_type }:file execute_no_trans; neverallow mediaextractor { file_type fs_type }:file execute_no_trans;
# mediaextractor should never need network access. Disallow all sockets # mediaextractor should never need network access. Disallow network sockets.
# other than those needed for normal system functions neverallow mediaextractor domain:{ tcp_socket udp_socket rawip_socket } *;
neverallow mediaextractor { domain -debuggerd -dumpstate -adbd -mediaextractor -logd userdebug_or_eng(`-su')}:socket_class_set *;
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment