diff options
Diffstat (limited to 'prebuilts/api/32.0/public/neverallow_macros')
| -rw-r--r-- | prebuilts/api/32.0/public/neverallow_macros | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/prebuilts/api/32.0/public/neverallow_macros b/prebuilts/api/32.0/public/neverallow_macros new file mode 100644 index 000000000..59fa441d2 --- /dev/null +++ b/prebuilts/api/32.0/public/neverallow_macros @@ -0,0 +1,15 @@ +# +# Common neverallow permissions +define(`no_w_file_perms', `{ append create link unlink relabelfrom rename setattr write }') +define(`no_rw_file_perms', `{ no_w_file_perms open read ioctl lock watch watch_mount watch_sb watch_with_perm watch_reads }') +define(`no_x_file_perms', `{ execute execute_no_trans }') +define(`no_w_dir_perms', `{ add_name create link relabelfrom remove_name rename reparent rmdir setattr write }') + +##################################### +# neverallow_establish_socket_comms(src, dst) +# neverallow src domain establishing socket connections to dst domain. +# +define(`neverallow_establish_socket_comms', ` + neverallow $1 $2:socket_class_set { connect sendto }; + neverallow $1 $2:unix_stream_socket connectto; +') |