tree 2506f6c2f35004be4f5f0bf039e580caa2ef9dfe
parent 7ef348b1bac77418862f7c22ecefb51ec3517808
author Nick Kralevich <nnk@google.com> 1422495990 -0800
committer Nick Kralevich <nnk@google.com> 1422572574 -0800

appdomain: relax netlink_socket neverallow rule

Relax the neverallow netlink restrictions for app domains.
In particular, some non-AOSP app domains may use netlink sockets
to communicate with a kernel driver.

Continue to neverallow generic netlink sockets for untrusted_app.
The intention here is that only app domains which explicitly need
this functionality should be able to request it.

This change does not add or remove any SELinux rules. Rather, it
just changes SELinux compile time assertions, as well as allowing
this behavior in CTS.

Modify other neverallow rules to use "domain" instead of "self".
Apps shouldn't be able to handle netlink sockets, even those
created in other SELinux domains.

(cherry picked from commit d31936f89c49bc5c54b84bd5095f3c417da14935)

Bug: 19198997
Change-Id: Icfed1ee66f082df1117b090341f62981f01bc849