Skip to content
Snippets Groups Projects
Commit d86b3d7c authored by Chad Brubaker's avatar Chad Brubaker Committed by android-build-merger
Browse files

Merge "Disallow access to proc_net for ephemeral_app" am: 2e7fa9d8 am: 98c4f82e

am: 1c4472a9

Change-Id: I6b0ccf590d69dc2f23e3af5387e53bdc6de624be
parents 0a7b8e59 1c4472a9
Branches
Tags
No related merge requests found
......@@ -133,7 +133,7 @@ userdebug_or_eng(`
# Write to /proc/net/xt_qtaguid/ctrl file.
allow appdomain qtaguid_proc:file rw_file_perms;
# read /proc/net/xt_qtguid/stats
r_dir_file(appdomain, proc_net)
r_dir_file({ appdomain -ephemeral_app}, proc_net)
# Everybody can read the xt_qtaguid resource tracking misc dev.
# So allow all apps to read from /dev/xt_qtaguid.
allow appdomain qtaguid_device:chr_file r_file_perms;
......
......@@ -52,3 +52,7 @@ neverallow ephemeral_app proc:file { no_rw_file_perms no_x_file_perms };
# Directly access external storage
neverallow ephemeral_app { sdcard_type media_rw_data_file }:file {open create};
neverallow ephemeral_app { sdcard_type media_rw_data_file }:dir search;
# Avoid reads to proc_net, it contains too much device wide information about
# ongoing connections.
neverallow ephemeral_app proc_net:file no_rw_file_perms;
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment