commit d7ba70bcc6df3874bd67d8d56d6fcccf09f4f802
author Nick Kralevich <nnk@google.com> Mon Aug 28 14:47:49 2017 +0000
committer android-build-merger <android-build-merger@google.com> Mon Aug 28 14:47:49 2017 +0000
tree cd40cf46edae0ff5bcd2e46f4344eab352080c07
parent 638317bc788441a1f41b0ba6f2ca2af3da480eff
parent b40a1d5c1dbe449ac2d9d60ba9872477cbf69a97

Merge "init.rc: Lock down access to /proc/net/fib_trie" into oc-mr1-dev am: c3090ba2f4
am: 566ae3ebf6

Change-Id: I1eac78bcfe0c8333722a511cdd99791e5139d4ea

rootdir/init.rc

diff --git a/rootdir/init.rc b/rootdir/init.rc
index 7c3697b..544d9ee 100644
--- a/rootdir/init.rc
+++ b/rootdir/init.rc
@@ -148,6 +148,9 @@
     write /proc/sys/net/ipv4/conf/all/accept_redirects 0
     write /proc/sys/net/ipv6/conf/all/accept_redirects 0
 
+    # /proc/net/fib_trie leaks interface IP addresses
+    chmod 0400 /proc/net/fib_trie
+
     # Create cgroup mount points for process groups
     mkdir /dev/cpuctl
     mount cgroup none /dev/cpuctl cpu