diff options
| author | Bram Bonné <brambonne@google.com> | 2021-04-30 11:50:19 +0200 |
|---|---|---|
| committer | Michael Bestas <mkbestas@lineageos.org> | 2022-11-05 19:06:48 +0200 |
| commit | e31f087fb864910726b36f22244a6043d503ff1f (patch) | |
| tree | 0cf4e1e3a9e36e5bbd6da431704fe9a2795d510c /tools/perf/scripts/python/cs-trace-ranges.py | |
| parent | 80675d431434865472cb2e18bf62b490ac3d8667 (diff) | |
ANDROID: selinux: modify RTM_GETNEIGH{TBL}
Map the permission gating RTM_GETNEIGH/RTM_GETNEIGHTBL messages to a
new permission so that it can be distinguished from the other netlink
route permissions in selinux policy. The new permission is triggered by
a flag set in system images T and up.
This change is intended to be backported to all kernels that a T system
image can run on top of.
Bug: 171572148
Test: atest NetworkInterfaceTest
Test: atest CtsSelinuxTargetSdkCurrentTestCases
Test: atest bionic-unit-tests-static
Test: On Cuttlefish, run combinations of:
- Policy bit set or omitted (see https://r.android.com/1701847)
- This patch applied or omitted
- App having nlmsg_readneigh permission or not
Verify that only the combination of this patch + the policy bit being
set + the app not having the nlmsg_readneigh permission prevents the
app from sending RTM_GETNEIGH messages.
Change-Id: I4bcfce4decb34ea9388eeedfc4be67403de8a980
Signed-off-by: Bram Bonné <brambonne@google.com>
(cherry picked from commit fac07550bdac9adea0dbe3edbdbec7a9a690a178)
(cherry picked from commit 32d7afd1472c3cce509a3455b40a575540eac780)
CVE-2022-20399
Signed-off-by: Kevin F. Haggerty <haggertk@lineageos.org>
Diffstat (limited to 'tools/perf/scripts/python/cs-trace-ranges.py')
0 files changed, 0 insertions, 0 deletions