Skip to content
Snippets Groups Projects
Commit c086c03a authored by dcashman's avatar dcashman Committed by android-build-merger
Browse files

Restore system_server ioctl socket access. am: ec3285cd am: 84992ead am: b91eadd7

am: 017b56d5

Change-Id: I0c999d74e29e6de71bcc7572036ac14b55dc42fa
parents bcc90259 017b56d5
Branches
Tags
No related merge requests found
...@@ -175,7 +175,7 @@ allowxperm domain domain:{ unix_dgram_socket unix_stream_socket } ...@@ -175,7 +175,7 @@ allowxperm domain domain:{ unix_dgram_socket unix_stream_socket }
### ###
# All socket ioctls must be restricted to a whitelist. # All socket ioctls must be restricted to a whitelist.
neverallowxperm domain domain:socket_class_set ioctl { 0 }; neverallowxperm { domain -system_server } domain:socket_class_set ioctl { 0 };
# Do not allow any domain other than init or recovery to create unlabeled files. # Do not allow any domain other than init or recovery to create unlabeled files.
neverallow { domain -init -recovery } unlabeled:dir_file_class_set create; neverallow { domain -init -recovery } unlabeled:dir_file_class_set create;
......
...@@ -81,7 +81,7 @@ allow system_server self:netlink_generic_socket create_socket_perms_no_ioctl; ...@@ -81,7 +81,7 @@ allow system_server self:netlink_generic_socket create_socket_perms_no_ioctl;
# to the kernel. The ioctl permission is specifically omitted here, but may # to the kernel. The ioctl permission is specifically omitted here, but may
# be added to device specific policy along with the ioctl commands to be # be added to device specific policy along with the ioctl commands to be
# whitelisted. # whitelisted.
allow system_server self:socket create_socket_perms_no_ioctl; allow system_server self:socket create_socket_perms;
# Set and get routes directly via netlink. # Set and get routes directly via netlink.
allow system_server self:netlink_route_socket nlmsg_write; allow system_server self:netlink_route_socket nlmsg_write;
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment