29 lines
1.3 KiB
Text
29 lines
1.3 KiB
Text
|
# wpa supplicant macsec or equivalent
|
||
|
|
type wpa_supplicant_macsec, domain;
|
||
|
|
type wpa_supplicant_macsec_exec, exec_type, vendor_file_type, file_type;
|
||
|
|
init_daemon_domain(wpa_supplicant_macsec)
|
||
|
|
|
||
|
|
net_domain(wpa_supplicant_macsec)
|
||
|
|
|
||
|
|
# Allow wpa_supplicant to configure nl80211
|
||
|
|
allow wpa_supplicant_macsec proc_net_type:file write;
|
||
|
|
|
||
|
|
# in addition to ioctls allowlisted for all domains, grant wpa_supplicant_macsec priv_sock_ioctls.
|
||
|
|
allowxperm wpa_supplicant_macsec self:udp_socket ioctl priv_sock_ioctls;
|
||
|
|
|
||
|
|
r_dir_file(wpa_supplicant_macsec, sysfs_type)
|
||
|
|
r_dir_file(wpa_supplicant_macsec, proc_net_type)
|
||
|
|
|
||
|
|
allow wpa_supplicant_macsec self:global_capability_class_set { setuid net_admin setgid net_raw };
|
||
|
|
allow wpa_supplicant_macsec cgroup:dir create_dir_perms;
|
||
|
|
allow wpa_supplicant_macsec cgroup_v2:dir create_dir_perms;
|
||
|
|
allow wpa_supplicant_macsec self:netlink_route_socket nlmsg_write;
|
||
|
|
allow wpa_supplicant_macsec self:netlink_socket create_socket_perms_no_ioctl;
|
||
|
|
allow wpa_supplicant_macsec self:netlink_generic_socket create_socket_perms_no_ioctl;
|
||
|
|
allow wpa_supplicant_macsec self:packet_socket create_socket_perms;
|
||
|
|
allowxperm wpa_supplicant_macsec self:packet_socket ioctl { unpriv_sock_ioctls priv_sock_ioctls unpriv_tty_ioctls };
|
||
|
|
|
||
|
|
binder_use(wpa_supplicant_macsec)
|
||
|
|
hal_client_domain(wpa_supplicant_macsec, hal_macsec)
|
||
|
|
|