audioserver: drop inet group
The audioserver process is specifically prohibited from accessing the network. See https://android.googlesource.com/platform/system/sepolicy/+/7ca6fc8629d34b6be6ca99806814a78a5f6e2b31/private/audioserver.te#91 line 91 # Media processing code is inherently risky and thus should have limited # permissions and be isolated from the rest of the system and network. # Lengthier explanation here: # https://android-developers.googleblog.com/2016/05/hardening-media-stack.html neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *; Since SELinux doesn't allow audioserver to access tcp/udp sockets, it doesn't make any sense to have audioserver be in the inet group. Discovered while reviewing https://android-review.googlesource.com/c/platform/frameworks/base/+/968497 Similarly, I suspect other groups listed here are also unnecessary and can be cleaned up in a future commit. Test: compiles and boots Change-Id: Ic331f301565aee911de30322dd4c3811529597ee
Loading
Please register or sign in to comment