[Samsung Galaxy Nexus] aosp:
[MENTION=4294697]kyle[/MENTION] We buds dude don't let the trolls confuse you but I promise last one for the night

unconfined: remove internet access · 0db95cc · CyanogenMod/android_external_sepolicy · GitHub - http://goo.gl/ebj1Pk

Don't allow unconfined domains to access the internet. Restrict internet functionality to domains which explicitly declare their use. Removing internet access from unconfined domains helps protect daemons from network level attacks. In unconfined.te, expand out socket_class_set, and explicitly remove tcp_socket, udp_socket, rawip_socket, packet_socket, and appletalk_socket. Remove name_bind, node_bind and name_connect rules, since they only apply to internet accessible rules. Add limited udp support to init.te. This is needed to bring up the loopback interface at boot.

Don't allow unconfined domains to access the internet. Restrict

internet functionality to domains which explicitly declare their

use. Removing internet access from unconfined domains helps

protect daemons from network level attacks.

In unconfined.te, expand out socket_class_set, and explicitly remove

tcp_socket, udp_socket, rawip_socket, packet_socket, and

appletalk_socket. Remove name_bind, node_bind and name_connect rules,

since they only apply to internet accessible rules.

Add limited udp support to init.te. This is needed to bring up

the loopback interface at boot.

Add access control for each service_manager action. · 344fc10 · CyanogenMod/android_external_sepolicy · GitHub - http://goo.gl/qDcUzg

Add SELinux MAC for the service manager actions list

and find. Add the list and find verbs to the

service_manager class. Add policy requirements for

service_manager to enforce policies to binder_use

macro.

Further refined service_manager auditallow statements. · 4a24475 · CyanogenMod/android_external_sepolicy · GitHub - http://goo.gl/hJov6C

Further refined auditallow statements associated with

service_manager and added dumpstate to the

service_manager_local_audit_domain.

DO NOT MERGE: Remove service_manager audit_allows. · bf69632 · CyanogenMod/android_external_sepolicy · GitHub - http://goo.gl/skZw5b

Remove the audit_allow rules from lmp-dev because

we will not be tightening any further so these logs

will not be useful.

Align SELinux property policy with init property_perms. · fee4915 · CyanogenMod/android_external_sepolicy · GitHub - http://goo.gl/XcTxxf

Introduce a net_radio_prop type for net. properties that can be

set by radio or system.

Introduce a system_radio_prop type for sys. properties that can be

set by radio or system.

Introduce a dhcp_prop type for properties that can be set by dhcp or system.

Drop the rild_prop vs radio_prop distinction; this was an early

experiment to see if we could separate properties settable by rild

versus other radio UID processes but it did not pan out.

Remove the ability to set properties from unconfineddomain.

Allow init to set any property. Allow recovery to set ctl_default_prop

to restart adbd.

sepolicy: remove conflicting selinux-policies · 08c1a82 · stargo/android_device_motorola_omap4-common · GitHub - http://goo.gl/R3JZ5r

Make the mediaserver domain enforcing. · f0ffff0 · CyanogenMod/android_external_sepolicy · GitHub - http://goo.gl/i0fVqi

Restrict use of context= mount options. · 75e2ef9 · CyanogenMod/android_external_sepolicy · GitHub - http://goo.gl/w1QvhI

Prior to this change, the init and recovery domains were

allowed unrestricted use of context= mount options to force

all files within a given filesystem to be treated as having a

security context specified at mount time. The context= mount

option can be used in device-specific fstab.<board> files

to assign a context to filesystems that do not support labeling

such as vfat where the default label of sdcard_external is not

appropriate (e.g. /firmware on hammerhead).

Restrict the use of context= mount options to types marked with the

contextmount_type attribute, and then remove write access from

such types from unconfineddomain and prohibit write access to such

types via neverallow. This ensures that the no write to /system

restriction cannot be bypassed via context= mount.

Accept command-line input for neverallow-check.

Also, divide each sepolicy-analyze function into its own component for simplified

command-line parsing and potentially eventual modularization.

https://android-review.googlesource.com/#/c/111626/

https://github.com/TresysTechnology/setools

https://github.com/TresysTechnology/refpolicy