platform_system_sepolicy/public/mtp.te

# vpn tunneling protocol manager
type mtp, domain;
type mtp_exec, exec_type, file_type;

net_domain(mtp)

# pptp policy
allow mtp self:socket create_socket_perms_no_ioctl;
allow mtp self:capability net_raw;
allow mtp ppp:process signal;
allow mtp vpn_data_file:dir search;
Add ppp/mtp policy. Initial policy for Point-to-Point tunneling and tunneling manager services. 2012-08-20 12:13:28 +02:00			`# vpn tunneling protocol manager`
Move domain_deprecated into private policy This attribute is being actively removed from policy. Since attributes are not being versioned, partners must not be able to access and use this attribute. Move it from private and verify in the logs that rild and tee are not using these permissions. Bug: 38316109 Test: build and boot Marlin Test: Verify that rild and tee are not being granted any of these permissions. Change-Id: I31beeb5bdf3885195310b086c1af3432dc6a349b 2017-05-15 22:19:03 +02:00			`type mtp, domain;`
Add ppp/mtp policy. Initial policy for Point-to-Point tunneling and tunneling manager services. 2012-08-20 12:13:28 +02:00			`type mtp_exec, exec_type, file_type;`

allow apps access to the keystore, dhcp/pptp fixes, wifi fixes and isolated_app access - allow all apps to connect to the keystore over unix socket - dhcp runs scripts in /system/etc/dhcpcd/dhcpcd-hooks and creates/removes lease files - mtp connects to dnsproxyd when a pptp vpn connection is established - allow appdomain to also open qtaguid_proc and release_app to read qtaguid_device - WifiWatchDog uses packet_socket when wifi comes up - apps interact with isolated_apps when an app uses an isolated service and uses sockets for that interaction - for apps with levelFromUid=true to interact with isolated_app, isolated_app must be an mlstrustedsubject Change-Id: I09ff676267ab588ad4c73f04d8f23dba863c5949 Signed-off-by: Joshua Brindle <jbrindle@tresys.com> 2012-09-26 00:52:54 +02:00			`net_domain(mtp)`
Make mtp permissive or unconfined. Also add rules from our policy. Change-Id: I096025c1820f0b51f1abdf249c744cba387e0a65 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-29 19:42:37 +01:00
			`# pptp policy`
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe 2016-05-17 06:12:17 +02:00			`allow mtp self:socket create_socket_perms_no_ioctl;`
Make mtp permissive or unconfined. Also add rules from our policy. Change-Id: I096025c1820f0b51f1abdf249c744cba387e0a65 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-29 19:42:37 +01:00			`allow mtp self:capability net_raw;`
			`allow mtp ppp:process signal;`
			`allow mtp vpn_data_file:dir search;`