Merge "buildtime/cts enforce no inet access for media domains" into nyc-dev

audioserver.te

@@ -51,3 +51,5 @@ unix_socket_connect(audioserver, bluetooth, bluetooth)
 # domain transition
 neverallow audioserver { file_type fs_type }:file execute_no_trans;
 
+# audioserver should never need network access. Disallow network sockets.
+neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *;

cameraserver.te

@@ -34,3 +34,6 @@ allow cameraserver surfaceflinger_service:service_manager find;
 # cameraserver should never execute any executable without a
 # domain transition
 neverallow cameraserver { file_type fs_type }:file execute_no_trans;
+
+# cameraserver should never need network access. Disallow network sockets.
+neverallow cameraserver domain:{ tcp_socket udp_socket rawip_socket } *;

mediacodec.te

@@ -26,6 +26,5 @@ allow mediacodec ion_device:chr_file rw_file_perms;
 # domain transition
 neverallow mediacodec { file_type fs_type }:file execute_no_trans;
 
-# mediacodec should never need network access. Disallow all sockets
-# other than those needed for normal system functions
-neverallow mediacodec { domain -debuggerd -dumpstate -adbd -mediacodec -logd userdebug_or_eng(`-su')}:socket_class_set *;
+# mediacodec should never need network access. Disallow network sockets.
+neverallow mediacodec domain:{ tcp_socket udp_socket rawip_socket } *;

mediaextractor.te

@@ -21,6 +21,5 @@ allow mediaextractor mediaextractor_service:service_manager add;
 # domain transition
 neverallow mediaextractor { file_type fs_type }:file execute_no_trans;
 
-# mediaextractor should never need network access. Disallow all sockets
-# other than those needed for normal system functions
-neverallow mediaextractor { domain -debuggerd -dumpstate -adbd -mediaextractor -logd userdebug_or_eng(`-su')}:socket_class_set *;
+# mediaextractor should never need network access. Disallow network sockets.
+neverallow mediaextractor domain:{ tcp_socket udp_socket rawip_socket } *;