From 6ba4bc52425856e2bb6ed847c5b2f37e4ce36182 Mon Sep 17 00:00:00 2001 From: Red 42 Date: Tue, 21 Apr 2026 10:26:58 +0300 Subject: [PATCH] net: Forbid RTM_GETADDR RTM_GETADDR reveals whether VPN is active. Forbid querying it directly by non-privileged apps Fixes https://github.com/GrapheneOS/os-issue-tracker/issues/5225 --- prebuilts/api/202404/private/net.te | 8 ++++++++ prebuilts/api/202404/public/net.te | 2 +- prebuilts/api/202504/private/net.te | 8 ++++++++ prebuilts/api/29.0/public/net.te | 2 +- prebuilts/api/30.0/public/net.te | 10 +++++++++- prebuilts/api/31.0/public/net.te | 10 +++++++++- prebuilts/api/32.0/public/net.te | 10 +++++++++- prebuilts/api/33.0/private/net.te | 7 +++++++ prebuilts/api/33.0/public/net.te | 2 +- prebuilts/api/34.0/private/net.te | 8 ++++++++ prebuilts/api/34.0/public/net.te | 2 +- private/net.te | 10 +++++++++- 12 files changed, 71 insertions(+), 8 deletions(-) diff --git a/prebuilts/api/202404/private/net.te b/prebuilts/api/202404/private/net.te index 4adf84c6fe..a1178a907e 100644 --- a/prebuilts/api/202404/private/net.te +++ b/prebuilts/api/202404/private/net.te @@ -17,3 +17,11 @@ allow { -untrusted_app_all } self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh }; +allow { + netdomain + -ephemeral_app + -mediaprovider + -sdk_sandbox_all + -untrusted_app_all +} self:netlink_route_socket nlmsg_read; + diff --git a/prebuilts/api/202404/public/net.te b/prebuilts/api/202404/public/net.te index aa30b62d80..230215e12a 100644 --- a/prebuilts/api/202404/public/net.te +++ b/prebuilts/api/202404/public/net.te @@ -14,7 +14,7 @@ allow netdomain self:{ icmp_socket udp_socket rawip_socket } create_socket_perms # Connect to ports. allow netdomain port_type:tcp_socket name_connect; # See changes to the routing table. -allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read }; +allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown }; # Talks to netd via dnsproxyd socket. unix_socket_connect(netdomain, dnsproxyd, netd) diff --git a/prebuilts/api/202504/private/net.te b/prebuilts/api/202504/private/net.te index 2c2f091436..0b3235cce8 100644 --- a/prebuilts/api/202504/private/net.te +++ b/prebuilts/api/202504/private/net.te @@ -17,6 +17,14 @@ allow { -untrusted_app_all } self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh }; +allow { + netdomain + -ephemeral_app + -mediaprovider + -sdk_sandbox_all + -untrusted_app_all +} self:netlink_route_socket nlmsg_read; + ### ### Domain with network access ### diff --git a/prebuilts/api/29.0/public/net.te b/prebuilts/api/29.0/public/net.te index afa2a9c8ce..6ab3dd5892 100644 --- a/prebuilts/api/29.0/public/net.te +++ b/prebuilts/api/29.0/public/net.te @@ -18,7 +18,7 @@ allow {netdomain -ephemeral_app} node_type:{ icmp_socket rawip_socket tcp_socket allow {netdomain -ephemeral_app} port_type:udp_socket name_bind; allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind; # See changes to the routing table. -allow netdomain self:netlink_route_socket { create read getattr write setattr lock append bind connect getopt setopt shutdown nlmsg_read }; +allow netdomain self:netlink_route_socket { create read getattr write setattr lock append bind connect getopt setopt shutdown }; # Talks to netd via dnsproxyd socket. unix_socket_connect(netdomain, dnsproxyd, netd) diff --git a/prebuilts/api/30.0/public/net.te b/prebuilts/api/30.0/public/net.te index e90715e66a..bf98d04642 100644 --- a/prebuilts/api/30.0/public/net.te +++ b/prebuilts/api/30.0/public/net.te @@ -18,7 +18,7 @@ allow {netdomain -ephemeral_app} node_type:{ icmp_socket rawip_socket tcp_socket allow {netdomain -ephemeral_app} port_type:udp_socket name_bind; allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind; # See changes to the routing table. -allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read }; +allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown }; # b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from # untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-29) are granted access elsewhere # to avoid app-compat breakage. @@ -29,6 +29,14 @@ allow { -untrusted_app_all } self:netlink_route_socket { bind nlmsg_readpriv }; +allow { + netdomain + -ephemeral_app + -mediaprovider + -sdk_sandbox_all + -untrusted_app_all +} self:netlink_route_socket nlmsg_read; + # Talks to netd via dnsproxyd socket. unix_socket_connect(netdomain, dnsproxyd, netd) diff --git a/prebuilts/api/31.0/public/net.te b/prebuilts/api/31.0/public/net.te index e90715e66a..bf98d04642 100644 --- a/prebuilts/api/31.0/public/net.te +++ b/prebuilts/api/31.0/public/net.te @@ -18,7 +18,7 @@ allow {netdomain -ephemeral_app} node_type:{ icmp_socket rawip_socket tcp_socket allow {netdomain -ephemeral_app} port_type:udp_socket name_bind; allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind; # See changes to the routing table. -allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read }; +allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown }; # b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from # untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-29) are granted access elsewhere # to avoid app-compat breakage. @@ -29,6 +29,14 @@ allow { -untrusted_app_all } self:netlink_route_socket { bind nlmsg_readpriv }; +allow { + netdomain + -ephemeral_app + -mediaprovider + -sdk_sandbox_all + -untrusted_app_all +} self:netlink_route_socket nlmsg_read; + # Talks to netd via dnsproxyd socket. unix_socket_connect(netdomain, dnsproxyd, netd) diff --git a/prebuilts/api/32.0/public/net.te b/prebuilts/api/32.0/public/net.te index e90715e66a..bf98d04642 100644 --- a/prebuilts/api/32.0/public/net.te +++ b/prebuilts/api/32.0/public/net.te @@ -18,7 +18,7 @@ allow {netdomain -ephemeral_app} node_type:{ icmp_socket rawip_socket tcp_socket allow {netdomain -ephemeral_app} port_type:udp_socket name_bind; allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind; # See changes to the routing table. -allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read }; +allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown }; # b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from # untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-29) are granted access elsewhere # to avoid app-compat breakage. @@ -29,6 +29,14 @@ allow { -untrusted_app_all } self:netlink_route_socket { bind nlmsg_readpriv }; +allow { + netdomain + -ephemeral_app + -mediaprovider + -sdk_sandbox_all + -untrusted_app_all +} self:netlink_route_socket nlmsg_read; + # Talks to netd via dnsproxyd socket. unix_socket_connect(netdomain, dnsproxyd, netd) diff --git a/prebuilts/api/33.0/private/net.te b/prebuilts/api/33.0/private/net.te index 9e15f41dd1..0710de971a 100644 --- a/prebuilts/api/33.0/private/net.te +++ b/prebuilts/api/33.0/private/net.te @@ -16,3 +16,10 @@ allow { -untrusted_app_all } self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh }; +allow { + netdomain + -ephemeral_app + -mediaprovider + -sdk_sandbox_all + -untrusted_app_all +} self:netlink_route_socket nlmsg_read; diff --git a/prebuilts/api/33.0/public/net.te b/prebuilts/api/33.0/public/net.te index 31c9c45bdc..8777ac95a6 100644 --- a/prebuilts/api/33.0/public/net.te +++ b/prebuilts/api/33.0/public/net.te @@ -14,7 +14,7 @@ allow netdomain self:{ icmp_socket udp_socket rawip_socket } create_socket_perms # Connect to ports. allow netdomain port_type:tcp_socket name_connect; # See changes to the routing table. -allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read }; +allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown }; # Talks to netd via dnsproxyd socket. unix_socket_connect(netdomain, dnsproxyd, netd) diff --git a/prebuilts/api/34.0/private/net.te b/prebuilts/api/34.0/private/net.te index 4adf84c6fe..a1178a907e 100644 --- a/prebuilts/api/34.0/private/net.te +++ b/prebuilts/api/34.0/private/net.te @@ -17,3 +17,11 @@ allow { -untrusted_app_all } self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh }; +allow { + netdomain + -ephemeral_app + -mediaprovider + -sdk_sandbox_all + -untrusted_app_all +} self:netlink_route_socket nlmsg_read; + diff --git a/prebuilts/api/34.0/public/net.te b/prebuilts/api/34.0/public/net.te index aa30b62d80..230215e12a 100644 --- a/prebuilts/api/34.0/public/net.te +++ b/prebuilts/api/34.0/public/net.te @@ -14,7 +14,7 @@ allow netdomain self:{ icmp_socket udp_socket rawip_socket } create_socket_perms # Connect to ports. allow netdomain port_type:tcp_socket name_connect; # See changes to the routing table. -allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read }; +allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown }; # Talks to netd via dnsproxyd socket. unix_socket_connect(netdomain, dnsproxyd, netd) diff --git a/private/net.te b/private/net.te index 3e44b2d846..0132a26ce6 100644 --- a/private/net.te +++ b/private/net.te @@ -20,6 +20,14 @@ allow { -untrusted_app_all } self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh }; +allow { + netdomain + -ephemeral_app + -mediaprovider + -sdk_sandbox_all + -untrusted_app_all +} self:netlink_route_socket nlmsg_read; + ### ### Domain with network access ### @@ -31,7 +39,7 @@ allow netdomain self:{ icmp_socket udp_socket rawip_socket } create_socket_perms # Connect to ports. allow netdomain port_type:tcp_socket name_connect; # See changes to the routing table. -allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read nlmsg }; +allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg }; allowxperm netdomain self:netlink_route_socket nlmsg unpriv_route_socket_nlmsgs; # Talks to netd via dnsproxyd socket.