tequilaOS/platform_build
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix SELinux settings for WiFi in Treble

Browse source 
am: 760871c753

Change-Id: I7865e2c9edf9f3148e5728f8a1a8492730743183
This commit is contained in:
Bjoern Johansson 2018-03-23 15:58:55 +00:00 committed by android-build-merger
commit 1b6dde54a0
6 changed files with 38 additions and 23 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
target/board/generic/sepolicy/dhcpclient.te
View file

@ -1,6 +1,6 @@
# DHCP client
type dhcpclient, domain, domain_deprecated;
type dhcpclient_exec, exec_type, file_type;
type dhcpclient, domain;
type dhcpclient_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(dhcpclient)
net_domain(dhcpclient)
@ -9,8 +9,12 @@ allow dhcpclient execns:fd use;
set_prop(dhcpclient, net_eth0_prop);
allow dhcpclient self:capability { net_admin net_raw };
allow dhcpclient self:packet_socket { create bind ioctl read write };
allow dhcpclient self:udp_socket { ioctl create };
allow dhcpclient self:udp_socket create;
allow dhcpclient self:netlink_route_socket { write nlmsg_write };
allow dhcpclient varrun_file:dir search;
allow dhcpclient self:packet_socket { create bind write read };
allowxperm dhcpclient self:udp_socket ioctl { SIOCSIFFLAGS
SIOCSIFADDR
SIOCSIFNETMASK
SIOCSIFMTU
SIOCGIFHWADDR };

4
target/board/generic/sepolicy/dhcpserver.te
View file

@ -1,6 +1,6 @@
# DHCP server
type dhcpserver, domain, domain_deprecated;
type dhcpserver_exec, exec_type, file_type;
type dhcpserver, domain;
type dhcpserver_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(dhcpserver)
net_domain(dhcpserver)

10
target/board/generic/sepolicy/execns.te
View file

@ -1,11 +1,12 @@
# Network namespace transitions
type execns, domain, domain_deprecated;
type execns_exec, exec_type, file_type;
type execns, domain;
type execns_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(execns)
allow execns varrun_file:dir search;
allow execns self:capability sys_admin;
allow execns proc:file { open read };
#Allow execns itself to be run by init in its own domain
domain_auto_trans(init, execns_exec, execns);
@ -19,8 +20,3 @@ domain_auto_trans(execns, dhcpserver_exec, dhcpserver);
# Allow hostapd to be run by execns in its own domain
domain_auto_trans(execns, hostapd_exec, hostapd);
allow hostapd execns:fd use;
# Allow dnsmasq to be run by execns in its own domain
domain_auto_trans(execns, dnsmasq_exec, dnsmasq);
allow dnsmasq execns:fd use;

9
target/board/generic/sepolicy/file_contexts
View file

@ -17,11 +17,12 @@
/dev/ttyS2 u:object_r:console_device:s0
/vendor/bin/init\.ranchu-core\.sh u:object_r:goldfish_setup_exec:s0
/vendor/bin/init\.ranchu-net\.sh u:object_r:goldfish_setup_exec:s0
/vendor/bin/init\.wifi\.sh u:object_r:goldfish_setup_exec:s0
/vendor/bin/qemu-props u:object_r:qemu_props_exec:s0
/system/bin/execns u:object_r:execns_exec:s0
/system/bin/ipv6proxy u:object_r:ipv6proxy_exec:s0
/system/bin/dhcpclient u:object_r:dhcpclient_exec:s0
/system/bin/dhcpserver u:object_r:dhcpserver_exec:s0
/vendor/bin/execns u:object_r:execns_exec:s0
/vendor/bin/ipv6proxy u:object_r:ipv6proxy_exec:s0
/vendor/bin/dhcpclient u:object_r:dhcpclient_exec:s0
/vendor/bin/dhcpserver u:object_r:dhcpserver_exec:s0
/vendor/bin/hw/android\.hardware\.drm@1\.0-service\.widevine u:object_r:hal_drm_widevine_exec:s0

19
target/board/generic/sepolicy/goldfish_setup.te
View file

@ -16,10 +16,23 @@ allow goldfish_setup vendor_shell_exec:file { rx_file_perms };
set_prop(goldfish_setup, ctl_default_prop);
# Set up WiFi
allow goldfish_setup self:netlink_route_socket nlmsg_write;
allow goldfish_setup self:netlink_socket create_socket_perms;
allow goldfish_setup self:netlink_route_socket { create nlmsg_write setopt bind getattr read write nlmsg_read };
allow goldfish_setup self:netlink_socket create_socket_perms_no_ioctl;
allow goldfish_setup self:capability { sys_module sys_admin };
allow goldfish_setup varrun_file:dir { mounton open read write add_name search remove_name };
allow goldfish_setup varrun_file:file { mounton getattr create read write open unlink };
allow goldfish_setup execns_exec:file rx_file_perms;
allow goldfish_setup proc_net:file w_file_perms;
allow goldfish_setup proc_net:file rw_file_perms;
allow goldfish_setup proc:file r_file_perms;
set_prop(goldfish_setup, ctl_default_prop);
allow goldfish_setup system_data_file:dir getattr;
allow goldfish_setup kernel:system module_request;
# Allow goldfish_setup to run /system/bin/ip and /system/bin/iw
allow goldfish_setup system_file:file execute_no_trans;
# Allow goldfish_setup to run init.wifi.sh
allow goldfish_setup goldfish_setup_exec:file execute_no_trans;
# iw
allow goldfish_setup sysfs:file { read open };
# iptables
allow goldfish_setup system_file:file lock;
allow goldfish_setup self:rawip_socket { create getopt setopt };

5
target/board/generic/sepolicy/ipv6proxy.te
View file

@ -1,6 +1,6 @@
# IPv6 proxying
type ipv6proxy, domain, domain_deprecated;
type ipv6proxy_exec, exec_type, file_type;
type ipv6proxy, domain;
type ipv6proxy_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(ipv6proxy)
net_domain(ipv6proxy)
@ -13,3 +13,4 @@ allow ipv6proxy self:capability { sys_admin sys_module net_admin net_raw };
allow ipv6proxy self:packet_socket { bind create read };
allow ipv6proxy self:netlink_route_socket nlmsg_write;
allow ipv6proxy varrun_file:dir search;
allowxperm ipv6proxy self:udp_socket ioctl { SIOCSIFFLAGS SIOCGIFHWADDR };