tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Sepolicy for netutils_wrapper to use binder call"

Browse source 
am: 75b25384bb

Change-Id: Ib1dcfba93b5ba2fad7eec4ac9665e0486f6562be
This commit is contained in:
Luke Huang 2019-04-24 20:21:25 -07:00 committed by android-build-merger
commit a35b8cc42b
2 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
private/netutils_wrapper.te
View file

@ -15,8 +15,10 @@ allow netutils_wrapper self:netlink_route_socket ~ioctl;
allow netutils_wrapper self:netlink_xfrm_socket ~ioctl; allow netutils_wrapper self:netlink_xfrm_socket ~ioctl;
# For netutils (ndc) to be able to talk to netd # For netutils (ndc) to be able to talk to netd
allow netutils_wrapper netd_socket:sock_file { open getattr read write append }; allow netutils_wrapper netd_service:service_manager find;
allow netutils_wrapper netd:unix_stream_socket { read getattr connectto }; allow netutils_wrapper dnsresolver_service:service_manager find;
binder_use(netutils_wrapper);
binder_call(netutils_wrapper, netd);
# For vendor code that update the iptables rules at runtime. They need to reload # For vendor code that update the iptables rules at runtime. They need to reload
# the whole chain including the xt_bpf rules. They need to access to the pinned # the whole chain including the xt_bpf rules. They need to access to the pinned

2
public/netd.te
View file

@ -138,6 +138,7 @@ neverallow {
-dumpstate -dumpstate
-network_stack -network_stack
-netd -netd
-netutils_wrapper
} netd_service:service_manager find; } netd_service:service_manager find;
# only system_server, dumpstate and network stack app may find dnsresolver service # only system_server, dumpstate and network stack app may find dnsresolver service
@ -147,6 +148,7 @@ neverallow {
-dumpstate -dumpstate
-network_stack -network_stack
-netd -netd
-netutils_wrapper
} dnsresolver_service:service_manager find; } dnsresolver_service:service_manager find;
# only netd can create the bpf maps # only netd can create the bpf maps