ca5bfb1ca7
SELinux policies have become stricter, this updates the emulator SELinux rules to accomodate these changes. It also adds rules for the new createns command with the accompanying execns changes that are needed to work with an updated filesystem layout. BUG: 74514143 Test: Compile emulator images and verify that WiFi works Change-Id: I4b58cea681a1e41b0cb7368e1c696f74ce28f871
14 lines
496 B
Text
14 lines
496 B
Text
# Network namespace creation
|
|
type createns, domain;
|
|
type createns_exec, exec_type, vendor_file_type, file_type;
|
|
|
|
init_daemon_domain(createns)
|
|
|
|
allow createns self:capability { sys_admin net_raw setuid setgid };
|
|
allow createns varrun_file:dir { add_name search write };
|
|
allow createns varrun_file:file { create mounton open read write };
|
|
|
|
#Allow createns itself to be run by init in its own domain
|
|
domain_auto_trans(goldfish_setup, createns_exec, createns);
|
|
allow createns goldfish_setup:fd use;
|
|
|