platform_system_sepolicy/mtp.te

# vpn tunneling protocol manager
type mtp, domain;
type mtp_exec, exec_type, file_type;

init_daemon_domain(mtp)
net_domain(mtp)

# pptp policy
allow mtp self:socket create_socket_perms;
allow mtp self:capability net_raw;
allow mtp ppp:process signal;
allow mtp vpn_data_file:dir search;
Add ppp/mtp policy. Initial policy for Point-to-Point tunneling and tunneling manager services. 2012-08-20 12:13:28 +02:00			`# vpn tunneling protocol manager`
			`type mtp, domain;`
			`type mtp_exec, exec_type, file_type;`

			`init_daemon_domain(mtp)`
allow apps access to the keystore, dhcp/pptp fixes, wifi fixes and isolated_app access - allow all apps to connect to the keystore over unix socket - dhcp runs scripts in /system/etc/dhcpcd/dhcpcd-hooks and creates/removes lease files - mtp connects to dnsproxyd when a pptp vpn connection is established - allow appdomain to also open qtaguid_proc and release_app to read qtaguid_device - WifiWatchDog uses packet_socket when wifi comes up - apps interact with isolated_apps when an app uses an isolated service and uses sockets for that interaction - for apps with levelFromUid=true to interact with isolated_app, isolated_app must be an mlstrustedsubject Change-Id: I09ff676267ab588ad4c73f04d8f23dba863c5949 Signed-off-by: Joshua Brindle <jbrindle@tresys.com> 2012-09-26 00:52:54 +02:00			`net_domain(mtp)`
Make mtp permissive or unconfined. Also add rules from our policy. Change-Id: I096025c1820f0b51f1abdf249c744cba387e0a65 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-29 19:42:37 +01:00
			`# pptp policy`
			`allow mtp self:socket create_socket_perms;`
			`allow mtp self:capability net_raw;`
			`allow mtp ppp:process signal;`
			`allow mtp vpn_data_file:dir search;`