tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Grant TUNGETIFF ioctl and revoke SIOCGIFFLAGS ioctl to vmnic" into main am: 5a77925214

Browse source 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/3120132

Change-Id: I0e5ff9a9bb667d43027641cad61da692c0fe7415
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Seungjae Yoo 2024-06-13 01:44:15 +00:00 committed by Automerger Merge Worker
commit 6a28c726c4
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
private/vmnic.te
View file

@ -13,13 +13,13 @@ is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
# Let the vmnic domain use Binder.
binder_use(vmnic)
# Allow for creating TAP network interfaces.
# Allow for creating and deleting TAP network interfaces.
allow vmnic self:global_capability_class_set net_admin;
allow vmnic self:tun_socket create_socket_perms_no_ioctl;
allow vmnic tun_device:chr_file rw_file_perms;
allowxperm vmnic tun_device:chr_file ioctl { TUNSETIFF TUNSETPERSIST };
allowxperm vmnic tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF TUNSETPERSIST };
allow vmnic self:udp_socket create_socket_perms;
allowxperm vmnic self:udp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS };
allowxperm vmnic self:udp_socket ioctl SIOCSIFFLAGS;
# Only virtualizationservice can communicate to vmnic
neverallow { domain -virtualizationservice -servicemanager } vmnic:binder call;