diff --git a/Android.mk b/Android.mk index f3da45015e95fd6a1ffb628f615c715331c7ac1a..1b903bd752b2a17429d12e9bfb175433897a7536 100644 --- a/Android.mk +++ b/Android.mk @@ -36,6 +36,7 @@ sepolicy_build_files := security_classes \ policy_capabilities \ te_macros \ attributes \ + ioctl_macros \ *.te \ roles \ users \ diff --git a/ioctl_macros b/ioctl_macros new file mode 100644 index 0000000000000000000000000000000000000000..e71e0ce5a764520820c4e67723dd1164ad45a137 --- /dev/null +++ b/ioctl_macros @@ -0,0 +1,11 @@ +# socket ioctls allowed to unprivileged apps +define(`unpriv_sock_ioctls', ` +{ +# all socket ioctls except the Mac address SIOCGIFHWADDR 0x8927 +0x8900-0x8926 0x8928-0x89ff +# all wireless extensions ioctls except get/set essid +# IOCSIWESSID 0x8B1A SIOCGIWESSID 0x8B1B +0x8B00-0x8B09 0x8B1C-0x8BFF +# commonly used TTY ioctls +0x5411 0x5451 +}') diff --git a/isolated_app.te b/isolated_app.te index 1cede96cbe3dab9e0cf83cba31549e5031ab15e6..b50bb783c425c61b968fea6a197b01a6a41cabe5 100644 --- a/isolated_app.te +++ b/isolated_app.te @@ -20,6 +20,9 @@ allow isolated_app display_service:service_manager find; service_manager_local_audit_domain(isolated_app) +# only allow unprivileged socket ioctl commands +allow isolated_app self:{ rawip_socket tcp_socket udp_socket } unpriv_sock_ioctls; + ##### ##### Neverallow ##### diff --git a/untrusted_app.te b/untrusted_app.te index e451c5d6b3507d8aec02603219001ea90d32e8c5..693a13cd697b254c11f0d53bd1608104a80e7fad 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -97,17 +97,8 @@ allow untrusted_app persistent_data_block_service:service_manager find; allow untrusted_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms; allow untrusted_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms; -# limit untrusted_apps access to MAC address ioctl -# MAC address is SIOCGIFHWADDR 0x8927 -# from include/uapi/linux/sockios.h -# #define SIOCGIFHWADDR 0x8927 /* Get hardware address */ -# Other general 0x89** ioctls should continue to be allowed. -# 0x8B00 from wireless extensions driver and is used by chrome to -# determine if wifi is present -# from include/uapi/linux/wireless.h: -# #define SIOCSIWCOMMIT 0x8B00 /* Commit pending changes to driver */ -allow untrusted_app self:{ rawip_socket tcp_socket udp_socket } { 0x5411 0x5451 0x8900-0x8926 0x8928-0x89ff 0x8b00-0x8bff }; -auditallow untrusted_app self:{ rawip_socket tcp_socket udp_socket } { 0x8b00-0x8bff }; +# only allow unprivileged socket ioctl commands +allow untrusted_app self:{ rawip_socket tcp_socket udp_socket } unpriv_sock_ioctls; # Allow GMS core to access perfprofd output, which is stored # in /data/misc/perfprofd/. GMS core will need to list all