tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Grant TUNGETIFF ioctl and revoke SIOCGIFFLAGS ioctl to vmnic

Browse source 
To delete TAP interface in vmnic, it should retrieve libc::ifreq struct
object from file descriptor of TAP interface, to execute SIOCSIFFLAGS
and TUNSETIFF ioctls.

On the other hand, we can reuse libc::ifreq struct for executing
SIOCSIFFLAGS ioctl constructed for executing TUNSETIFF and TUNSETPERSIST
ioctls. So we don't need to grant SIOSGIFFLAGS ioctl anymore, to get
libc::ifreq struct.

Bug: 340376951
Test: Presubmit
Change-Id: I448c8ca5366c0e27d5d5fe09bcb366c5f23650ac
This commit is contained in:
Seungjae Yoo 2024-06-11 10:14:01 +09:00
parent e357df7504
commit a217b1f191
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
private/vmnic.te
View file

@ -13,13 +13,13 @@ is_flag_enabled(RELEASE_AVF_ENABLE_NETWORK, `
# Let the vmnic domain use Binder. # Let the vmnic domain use Binder.
binder_use(vmnic) binder_use(vmnic)
# Allow for creating TAP network interfaces. # Allow for creating and deleting TAP network interfaces.
allow vmnic self:global_capability_class_set net_admin; allow vmnic self:global_capability_class_set net_admin;
allow vmnic self:tun_socket create_socket_perms_no_ioctl; allow vmnic self:tun_socket create_socket_perms_no_ioctl;
allow vmnic tun_device:chr_file rw_file_perms; allow vmnic tun_device:chr_file rw_file_perms;
allowxperm vmnic tun_device:chr_file ioctl { TUNSETIFF TUNSETPERSIST }; allowxperm vmnic tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF TUNSETPERSIST };
allow vmnic self:udp_socket create_socket_perms; allow vmnic self:udp_socket create_socket_perms;
allowxperm vmnic self:udp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS }; allowxperm vmnic self:udp_socket ioctl SIOCSIFFLAGS;
# Only virtualizationservice can communicate to vmnic # Only virtualizationservice can communicate to vmnic
neverallow { domain -virtualizationservice -servicemanager } vmnic:binder call; neverallow { domain -virtualizationservice -servicemanager } vmnic:binder call;