Skip to content
Snippets Groups Projects
Commit d31936f8 authored by Nick Kralevich's avatar Nick Kralevich
Browse files

appdomain: relax netlink_socket neverallow rule

Relax the neverallow netlink restrictions for app domains.
In particular, some non-AOSP app domains may use netlink sockets
to communicate with a kernel driver.

Continue to neverallow generic netlink sockets for untrusted_app.
The intention here is that only app domains which explicitly need
this functionality should be able to request it.

This change does not add or remove any SELinux rules. Rather, it
just changes SELinux compile time assertions, as well as allowing
this behavior in CTS.

Modify other neverallow rules to use "domain" instead of "self".
Apps shouldn't be able to handle netlink sockets, even those
created in other SELinux domains.

Change-Id: I40de0ae28134ce71e808e5ef4a39779b71897571
parent bfe4c8ba
Branches
No related tags found
No related merge requests found
......@@ -222,8 +222,7 @@ neverallow appdomain tee_device:chr_file { read write };
# Privileged netlink socket interfaces.
neverallow appdomain
self:{
netlink_socket
domain:{
netlink_firewall_socket
netlink_tcpdiag_socket
netlink_nflog_socket
......@@ -236,7 +235,7 @@ neverallow appdomain
# These messages are broadcast messages from the kernel to userspace.
# Do not allow the writing of netlink messages, which has been a source
# of rooting vulns in the past.
neverallow appdomain self:netlink_kobject_uevent_socket { write append };
neverallow appdomain domain:netlink_kobject_uevent_socket { write append };
# Sockets under /dev/socket that are not specifically typed.
neverallow appdomain socket_device:sock_file write;
......
......@@ -116,7 +116,10 @@ auditallow untrusted_app {
###
# Receive or send uevent messages.
neverallow untrusted_app self:netlink_kobject_uevent_socket *;
neverallow untrusted_app domain:netlink_kobject_uevent_socket *;
# Receive or send generic netlink messages
neverallow untrusted_app domain:netlink_socket *;
# Too much leaky information in debugfs. It's a security
# best practice to ensure these files aren't readable.
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment