1b307e75b3
Allow domain transitions from shell, su and adbd for qmuxd and netmgrd in case of engineering and user debug builds only CRs-fixed: 590265 Change-Id: Ibaad1d0d547dca13fa17f7c909c6347e59a24d97
48 lines
1.7 KiB
Text
48 lines
1.7 KiB
Text
type netmgrd, domain;
|
|
type netmgrd_exec, exec_type, file_type;
|
|
net_domain(netmgrd)
|
|
init_daemon_domain(netmgrd)
|
|
|
|
userdebug_or_eng(`
|
|
domain_auto_trans(shell, netmgrd_exec, netmgrd)
|
|
domain_auto_trans(su, netmgrd_exec, netmgrd)
|
|
domain_auto_trans(adbd, netmgrd_exec, netmgrd)
|
|
')
|
|
|
|
#Allow files to be written during the operation of netmgrd
|
|
file_type_auto_trans(netmgrd, system_data_file, data_test_data_file)
|
|
|
|
#Allow netmgrd operations
|
|
allow netmgrd netmgrd:capability { dac_override net_raw net_admin sys_module fsetid setgid setuid };
|
|
|
|
#Allow access to kernel modules
|
|
allow netmgrd kernel:system { module_request };
|
|
|
|
#Allow logging
|
|
allow netmgrd diag_device:chr_file { rw_file_perms };
|
|
allow netmgrd smem_log_device:chr_file { rw_file_perms };
|
|
|
|
#Allow operations on different types of sockets
|
|
allow netmgrd netmgrd:rawip_socket { create getopt setopt write };
|
|
allow netmgrd netmgrd:netlink_xfrm_socket { create bind };
|
|
allow netmgrd netmgrd:netlink_socket { write read create bind };
|
|
allow netmgrd netmgrd:socket { create ioctl };
|
|
allow netmgrd netmgrd:netlink_route_socket { setopt getattr write nlmsg_write };
|
|
allow netmgrd init:unix_stream_socket { connectto };
|
|
allow netmgrd property_socket:sock_file { write };
|
|
|
|
#Allow operations on qmux device sockets
|
|
allow netmgrd qmux_radio_socket:sock_file { create setattr getattr write unlink };
|
|
allow netmgrd qmux_radio_socket:dir { write add_name remove_name search };
|
|
|
|
#Allow communication with qmuxd
|
|
allow netmgrd qmuxd:unix_stream_socket { connectto };
|
|
|
|
#Allow writing of ipv6 network properties
|
|
allow netmgrd proc_net:file { write };
|
|
|
|
#Allow address configuration
|
|
allow netmgrd system_prop:property_service { set };
|
|
|
|
#Allow execution of commands in shell
|
|
allow netmgrd system_file:file { execute_no_trans };
|