Skip to content

net: Forbid RTM_GETADDR #78

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
red42red wants to merge 1 commit into
base: 16-qpr2
Choose a base branch
from
Open

net: Forbid RTM_GETADDR #78

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions prebuilts/api/202404/private/net.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,3 +17,11 @@ allow {
-untrusted_app_all
} self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh };

allow {
netdomain
-ephemeral_app
-mediaprovider
-sdk_sandbox_all
-untrusted_app_all
} self:netlink_route_socket nlmsg_read;

2 changes: 1 addition & 1 deletion prebuilts/api/202404/public/net.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ allow netdomain self:{ icmp_socket udp_socket rawip_socket } create_socket_perms
# Connect to ports.
allow netdomain port_type:tcp_socket name_connect;
# See changes to the routing table.
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read };
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown };

# Talks to netd via dnsproxyd socket.
unix_socket_connect(netdomain, dnsproxyd, netd)
Expand Down
8 changes: 8 additions & 0 deletions prebuilts/api/202504/private/net.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,14 @@ allow {
-untrusted_app_all
} self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh };

allow {
netdomain
-ephemeral_app
-mediaprovider
-sdk_sandbox_all
-untrusted_app_all
} self:netlink_route_socket nlmsg_read;

###
### Domain with network access
###
Expand Down
2 changes: 1 addition & 1 deletion prebuilts/api/29.0/public/net.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ allow {netdomain -ephemeral_app} node_type:{ icmp_socket rawip_socket tcp_socket
allow {netdomain -ephemeral_app} port_type:udp_socket name_bind;
allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind;
# See changes to the routing table.
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append bind connect getopt setopt shutdown nlmsg_read };
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append bind connect getopt setopt shutdown };

# Talks to netd via dnsproxyd socket.
unix_socket_connect(netdomain, dnsproxyd, netd)
Expand Down
10 changes: 9 additions & 1 deletion prebuilts/api/30.0/public/net.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ allow {netdomain -ephemeral_app} node_type:{ icmp_socket rawip_socket tcp_socket
allow {netdomain -ephemeral_app} port_type:udp_socket name_bind;
allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind;
# See changes to the routing table.
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read };
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown };
# b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from
# untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-29) are granted access elsewhere
# to avoid app-compat breakage.
Expand All @@ -29,6 +29,14 @@ allow {
-untrusted_app_all
} self:netlink_route_socket { bind nlmsg_readpriv };

allow {
netdomain
-ephemeral_app
-mediaprovider
-sdk_sandbox_all
-untrusted_app_all
} self:netlink_route_socket nlmsg_read;

# Talks to netd via dnsproxyd socket.
unix_socket_connect(netdomain, dnsproxyd, netd)

Expand Down
10 changes: 9 additions & 1 deletion prebuilts/api/31.0/public/net.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ allow {netdomain -ephemeral_app} node_type:{ icmp_socket rawip_socket tcp_socket
allow {netdomain -ephemeral_app} port_type:udp_socket name_bind;
allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind;
# See changes to the routing table.
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read };
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown };
# b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from
# untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-29) are granted access elsewhere
# to avoid app-compat breakage.
Expand All @@ -29,6 +29,14 @@ allow {
-untrusted_app_all
} self:netlink_route_socket { bind nlmsg_readpriv };

allow {
netdomain
-ephemeral_app
-mediaprovider
-sdk_sandbox_all
-untrusted_app_all
} self:netlink_route_socket nlmsg_read;

# Talks to netd via dnsproxyd socket.
unix_socket_connect(netdomain, dnsproxyd, netd)

Expand Down
10 changes: 9 additions & 1 deletion prebuilts/api/32.0/public/net.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ allow {netdomain -ephemeral_app} node_type:{ icmp_socket rawip_socket tcp_socket
allow {netdomain -ephemeral_app} port_type:udp_socket name_bind;
allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind;
# See changes to the routing table.
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read };
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown };
# b/141455849 gate RTM_GETLINK with a new permission nlmsg_readpriv and block access from
# untrusted_apps. Some untrusted apps (e.g. untrusted_app_25-29) are granted access elsewhere
# to avoid app-compat breakage.
Expand All @@ -29,6 +29,14 @@ allow {
-untrusted_app_all
} self:netlink_route_socket { bind nlmsg_readpriv };

allow {
netdomain
-ephemeral_app
-mediaprovider
-sdk_sandbox_all
-untrusted_app_all
} self:netlink_route_socket nlmsg_read;

# Talks to netd via dnsproxyd socket.
unix_socket_connect(netdomain, dnsproxyd, netd)

Expand Down
7 changes: 7 additions & 0 deletions prebuilts/api/33.0/private/net.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,3 +16,10 @@ allow {
-untrusted_app_all
} self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh };

allow {
netdomain
-ephemeral_app
-mediaprovider
-sdk_sandbox_all
-untrusted_app_all
} self:netlink_route_socket nlmsg_read;
2 changes: 1 addition & 1 deletion prebuilts/api/33.0/public/net.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ allow netdomain self:{ icmp_socket udp_socket rawip_socket } create_socket_perms
# Connect to ports.
allow netdomain port_type:tcp_socket name_connect;
# See changes to the routing table.
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read };
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown };

# Talks to netd via dnsproxyd socket.
unix_socket_connect(netdomain, dnsproxyd, netd)
Expand Down
8 changes: 8 additions & 0 deletions prebuilts/api/34.0/private/net.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,3 +17,11 @@ allow {
-untrusted_app_all
} self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh };

allow {
netdomain
-ephemeral_app
-mediaprovider
-sdk_sandbox_all
-untrusted_app_all
} self:netlink_route_socket nlmsg_read;

2 changes: 1 addition & 1 deletion prebuilts/api/34.0/public/net.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ allow netdomain self:{ icmp_socket udp_socket rawip_socket } create_socket_perms
# Connect to ports.
allow netdomain port_type:tcp_socket name_connect;
# See changes to the routing table.
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read };
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown };

# Talks to netd via dnsproxyd socket.
unix_socket_connect(netdomain, dnsproxyd, netd)
Expand Down
10 changes: 9 additions & 1 deletion private/net.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,14 @@ allow {
-untrusted_app_all
} self:netlink_route_socket { bind nlmsg_readpriv nlmsg_getneigh };

allow {
netdomain
-ephemeral_app
-mediaprovider
-sdk_sandbox_all
-untrusted_app_all
} self:netlink_route_socket nlmsg_read;

###
### Domain with network access
###
Expand All @@ -31,7 +39,7 @@ allow netdomain self:{ icmp_socket udp_socket rawip_socket } create_socket_perms
# Connect to ports.
allow netdomain port_type:tcp_socket name_connect;
# See changes to the routing table.
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg_read nlmsg };
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append connect getopt setopt shutdown nlmsg };
allowxperm netdomain self:netlink_route_socket nlmsg unpriv_route_socket_nlmsgs;

# Talks to netd via dnsproxyd socket.
Expand Down