Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
A
AndroidSystemSEPolicy
Manage
Activity
Members
Code
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Deploy
Releases
Container registry
Model registry
Analyze
Contributor analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
GitLab community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
Werner Sembach
AndroidSystemSEPolicy
Commits
d76ccadb
Commit
d76ccadb
authored
Jan 12, 2016
by
Jeff Vander Stoep
Committed by
android-build-merger
Jan 12, 2016
Browse files
Options
Downloads
Plain Diff
DO NOT MERGE: Further restrict access to socket ioctl commands am:
57531cac
am:
c0ce53cc
am:
f290a2dd
* commit '
f290a2dd
': DO NOT MERGE: Further restrict access to socket ioctl commands
parents
4fc1397d
f290a2dd
No related branches found
No related tags found
No related merge requests found
Changes
2
Show whitespace changes
Inline
Side-by-side
Showing
2 changed files
ioctl_macros
+9
-5
9 additions, 5 deletions
ioctl_macros
shell.te
+3
-0
3 additions, 0 deletions
shell.te
with
12 additions
and
5 deletions
ioctl_macros
+
9
−
5
View file @
d76ccadb
# socket ioctls allowed to unprivileged apps
# socket ioctls allowed to unprivileged apps
define(`unpriv_sock_ioctls', `
define(`unpriv_sock_ioctls', `
{
{
# all socket ioctls except the Mac address SIOCGIFHWADDR 0x8927
# all socket ioctls except:
0x8900-0x8926 0x8928-0x89ff
# 1) the Mac address SIOCGIFHWADDR 0x8927
# all wireless extensions ioctls except get/set essid
# 2) device private SIOCDEVPRIVATE-SIOCDEVPRIVLAST 0x89F0-0x89FF
# IOCSIWESSID 0x8B1A SIOCGIWESSID 0x8B1B
# 3) protocol private SIOCPROTOPRIVATE-SIOCPROTOPRIVLAST 0x89E0-0x89EF
0x8B00-0x8B09 0x8B1C-0x8BFF
0x8900-0x8926 0x8928-0x89DF
# all wireless extensions ioctls except:
# 1) get/set essid IOCSIWESSID 0x8B1A SIOCGIWESSID 0x8B1B
# 2) device private ioctls SIOCIWFIRSTPRIV-SIOCIWLASTPRIV 0x8BE0-0x8BFF
0x8B00-0x8B09 0x8B1C-0x8BDF
# commonly used TTY ioctls
# commonly used TTY ioctls
0x5411 0x5451
0x5411 0x5451
}')
}')
This diff is collapsed.
Click to expand it.
shell.te
+
3
−
0
View file @
d76ccadb
...
@@ -77,6 +77,9 @@ allow shell domain:process getattr;
...
@@ -77,6 +77,9 @@ allow shell domain:process getattr;
allow shell bootchart_data_file:dir rw_dir_perms;
allow shell bootchart_data_file:dir rw_dir_perms;
allow shell bootchart_data_file:file create_file_perms;
allow shell bootchart_data_file:file create_file_perms;
# only allow unprivileged socket ioctl commands
allow shell self:{ rawip_socket tcp_socket udp_socket } unpriv_sock_ioctls;
# Do not allow shell to hard link to any files.
# Do not allow shell to hard link to any files.
# In particular, if shell hard links to app data
# In particular, if shell hard links to app data
# files, installd will not be able to guarantee the deletion
# files, installd will not be able to guarantee the deletion
...
...
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment