diff --git a/app.te b/app.te index 097224472b0cf1efaff506c82ed203861aece76d..902200181e43ddac5933a2a1853b413270d85ce6 100644 --- a/app.te +++ b/app.te @@ -222,8 +222,7 @@ neverallow appdomain tee_device:chr_file { read write }; # Privileged netlink socket interfaces. neverallow appdomain - self:{ - netlink_socket + domain:{ netlink_firewall_socket netlink_tcpdiag_socket netlink_nflog_socket @@ -236,7 +235,7 @@ neverallow appdomain # These messages are broadcast messages from the kernel to userspace. # Do not allow the writing of netlink messages, which has been a source # of rooting vulns in the past. -neverallow appdomain self:netlink_kobject_uevent_socket { write append }; +neverallow appdomain domain:netlink_kobject_uevent_socket { write append }; # Sockets under /dev/socket that are not specifically typed. neverallow appdomain socket_device:sock_file write; diff --git a/untrusted_app.te b/untrusted_app.te index ceb70f28cf2891cdbaa747f592915a4c7a2f62de..ae65719948c7a2354a781eaaa20a1ae530331c06 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -116,7 +116,10 @@ auditallow untrusted_app { ### # Receive or send uevent messages. -neverallow untrusted_app self:netlink_kobject_uevent_socket *; +neverallow untrusted_app domain:netlink_kobject_uevent_socket *; + +# Receive or send generic netlink messages +neverallow untrusted_app domain:netlink_socket *; # Too much leaky information in debugfs. It's a security # best practice to ensure these files aren't readable.