{"push_id":1206758494,"size":1,"distinct_size":1,"ref":"refs/heads/caf/cyngn/stable/cm-12.1-YOG4P","head":"9c0552e3a520b00c617d768e9033c29a340661aa","before":"f207533d435f42a514d1e5eb5a9e902dbc3699f7","commits":[{"sha":"9c0552e3a520b00c617d768e9033c29a340661aa","author":{"name":"Nick Kralevich","email":"9fb1f2f123bed3d2f2ecce5f8d59b4a06d49fd24@google.com"},"message":"Remove generic socket access from untrusted processes\n\nSELinux defines various classes for various socket types, including\ntcp_socket, udp_socket, rawip_socket, netlink_socket, etc. Socket\nclasses not known to the SELinux kernel code get lumped into the generic\n\"socket\" class. In particular, this includes the AF_MSM_IPC socket\nclass.\n\nBluetooth using apps were granted access to this generic socket class at\none point in 2012. In 1601132086b054adc70e7f8f38ed24574c90bc37,\na TODO was added indicating that this access was likely unnecessary. In\ncb835a2852997dde0be2941173f8c879ebbef157, an auditallow was added to\ntest to see if this rule was actually used, and in master branch\nd0113ae0aed1a455834f26ec847b6ca8610e3b16, this rule was completely\ndeleted.\n\nRevoke access to the generic socket class for isolated_app,\nuntrusted_app, and shell for older Android releases. This is\nconceptually a backport of d0113ae0aed1a455834f26ec847b6ca8610e3b16, but\naffecting fewer domains to avoid potential breakage.\n\nAdd a neverallow rule asserting that this rule isn't present for the\nuntrusted domains. Contrary to our usual conventions, the neverallow\nrule is placed in bluetooth.te, to avoid merge conflicts and simplify\npatching.\n\nCYNGNOS-3020\n\nBug: 28612709\nBug: 25768265\nChange-Id: Ibfbb67777e448784bb334163038436f3c4dc1b51\n(cherry picked from commit 31c17cd4de87639f673c2073d72b87c0736e28fc)","distinct":true,"url":"https://api.github.com/repos/codeaurora-unoffical/platform-external-sepolicy/commits/9c0552e3a520b00c617d768e9033c29a340661aa"}]}
{"actor":{"display_login":"Mazda--"}}