rs: add tests to ensure rs cannot abuse app data
Test: build
Change-Id: I2ea39c767264339e300fceeb23c506883d23a14c
diff --git a/private/rs.te b/private/rs.te
index 5aa2d54..7fbea8c 100644
--- a/private/rs.te
+++ b/private/rs.te
@@ -28,3 +28,12 @@
# File descriptors passed from app to renderscript
allow rs untrusted_app_all:fd use;
+
+# rs can access app data, so ensure it can only be entered via an app domain and cannot have
+# CAP_DAC_OVERRIDE.
+neverallow rs rs:capability_class_set *;
+neverallow { domain -appdomain } rs:process { dyntransition transition };
+neverallow rs { domain -crash_dump }:process { dyntransition transition };
+neverallow rs app_data_file:file_class_set ~r_file_perms;
+# rs should never use network sockets
+neverallow rs *:network_socket_class_set *;
diff --git a/public/global_macros b/public/global_macros
index 962bca9..1a1d593 100644
--- a/public/global_macros
+++ b/public/global_macros
@@ -14,6 +14,7 @@
define(`dgram_socket_class_set', `{ udp_socket unix_dgram_socket }')
define(`stream_socket_class_set', `{ tcp_socket unix_stream_socket sctp_socket }')
define(`unpriv_socket_class_set', `{ tcp_socket udp_socket unix_stream_socket unix_dgram_socket sctp_socket }')
+define(`network_socket_class_set', `{ icmp_socket rawip_socket tcp_socket udp_socket }')
define(`ipc_class_set', `{ sem msgq shm ipc }')