unconfined: remove internet access
Don't allow unconfined domains to access the internet. Restrict
internet functionality to domains which explicitly declare their
use. Removing internet access from unconfined domains helps
protect daemons from network level attacks.
In unconfined.te, expand out socket_class_set, and explicitly remove
tcp_socket, udp_socket, rawip_socket, packet_socket, and
appletalk_socket. Remove name_bind, node_bind and name_connect rules,
since they only apply to internet accessible rules.
Add limited udp support to init.te. This is needed to bring up
the loopback interface at boot.
Change-Id: If756f3fed857f11e63a6c3a1a13263c57fdf930a
diff --git a/init.te b/init.te
index 2c00cb4..c781849 100644
--- a/init.te
+++ b/init.te
@@ -86,6 +86,9 @@
allow init property_data_file:dir create_dir_perms;
allow init property_data_file:file create_file_perms;
+# Run "ifup lo" to bring up the localhost interface
+allow init self:udp_socket { create ioctl };
+
###
### neverallow rules
###