Merge "disallow SIOCATMARK" am: 2ecdfb49 am: f9eb9314

am: 74e50cbf

Change-Id: I2151b1fcde1a26885297c8920b2b1560d6d1ac1f

public/domain.te

@@ -228,6 +228,10 @@ with_asan(`allow domain system_data_file:dir getattr;')
 # All socket ioctls must be restricted to a whitelist.
 neverallowxperm domain domain:socket_class_set ioctl { 0 };
 
+# b/68014825 and https://android-review.googlesource.com/516535
+# rfc6093 says that processes should not use the TCP urgent mechanism
+neverallowxperm domain domain:socket_class_set ioctl { SIOCATMARK };
+
 # TIOCSTI is only ever used for exploits. Block it.
 # b/33073072, b/7530569
 # http://www.openwall.com/lists/oss-security/2016/09/26/14