topjohnwu/selinux
1
0
Fork 0
mirror of https://github.com/topjohnwu/selinux.git synced 2025-03-01 07:55:42 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

libsepol: trigger new RTM_GETNEIGH{TBL} behavior

Browse Source 
Use one of the policy config bits to tell the kernel to start using
the nlmsg_readneigh on RTM_GETNEIGH and RTM_GETNEIGHTBL messages instead
of the previous behavior of using nlmsg_read.

Bug: 171572148
Test: atest NetworkInterfaceTest
Test: atest bionic-unit-tests-static
Test: atest CtsSelinuxTargetSdkCurrentTestCases
Test: On Cuttlefish, run combinations of:
    - Policy bit set or omitted
    - App having nlmsg_readneigh permission or not
  Verify that only the combination of the policy bit being set + the app
  not having the nlmsg_readneigh permission prevents the app from
  sending RTM_GETNEIGH messages.
Change-Id: I8598662b795feaeaeb8b0a7e676b684022861c37
This commit is contained in:
Bram Bonné 2021-05-11 12:33:24 +02:00
parent 130aa3e3a5
commit d3f2ab97e2
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libsepol/include/sepol/policydb/policydb.h
View File

@ -791,7 +791,8 @@ extern int policydb_set_target_platform(policydb_t *p, int platform);
#define POLICYDB_CONFIG_UNKNOWN_MASK (DENY_UNKNOWN | REJECT_UNKNOWN | ALLOW_UNKNOWN)
#define POLICYDB_CONFIG_ANDROID_NETLINK_ROUTE 1 << 31;
#define POLICYDB_CONFIG_ANDROID_NETLINK_ROUTE (1 << 31)
#define POLICYDB_CONFIG_ANDROID_NETLINK_GETNEIGH (1 << 30)
#define OBJECT_R "object_r"
#define OBJECT_R_VAL 1

1
libsepol/src/write.c
View File

@ -2138,6 +2138,7 @@ int policydb_write(policydb_t * p, struct policy_file *fp)
config |= (POLICYDB_CONFIG_UNKNOWN_MASK & p->handle_unknown);
config |= POLICYDB_CONFIG_ANDROID_NETLINK_ROUTE;
config |= POLICYDB_CONFIG_ANDROID_NETLINK_GETNEIGH;
/* Write the magic number and string identifiers. */
items = 0;