Commit graph

9 commits

Author SHA1 Message Date
Chiachang Wang
e063585bbf Add permission for NetworkStack updatability
NetworkStack will need to use netlink_tcpdiag_socket to get tcp
info. In order to support updatability for NetworkStack as it's
a mainline module, get the information from kernel directly to
reduce the dependecy with framework.

Test: Build and test if NetworkStack can get the tcp_info without
SEPolicy exception
Bug: 136162280

Change-Id: I8f584f27d5ece5e97090fb5fafe8c70c5cbbe123
2019-10-12 21:21:10 +09:00
Roshan Pius
386cf9d957 sepolicy(wifi): Allow audio service access from wifi
Denial log:
10-03 13:37:05.726   603   603 I auditd  : avc:  denied  { find }
for pid=5443 uid=1073 name=media.audio_policy scontext=u:r:network_stack:s0
`1tcontext=u:object_r:audioserver_service:s0 tclass=service_manager permissive=0

Bug: 142053371
Bug: 135691051
Test: Device boots up and connects to network. No selinux denial seen
from network_stack

Change-Id: I0907504d02c987398467148c26a0847b5f8a7a8c
2019-10-03 08:19:17 -07:00
Roshan Pius
1086c7d71d wifi_stack: Move to network_stack process
The wifi stack APK will run inside the network_stack process. So, move
the sepolicy rules for wifi stack inside the network stack rules.

Bug: 135691051
Test: Manual tests
- manual connect to wifi networks
- Remove networks
Test: Will send for ACTS wifi regression testing
Change-Id: I9d5da80852f22fa1d12b2dbbc76b9e06c1275310
(cherry-picked from b83abf7af3df64e0d3c1b22548f2344b55aece28)
2019-10-02 11:49:43 -07:00
Xiao Ma
c06f0f602a Allow the netowrk stack to access its own data files.
After moving IpMemoryStore service to network stack module(aosp/906907),
the following untracked SELinux denials are observed on boot.

W id.networkstack: type=1400 audit(0.0:63): avc: denied { write } for
name="com.android.networkstack" dev="sda13" ino=704810
scontext=u:r:network_stack:s0:c49,c260,c512,c768
tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=0

Add radio_data_file type for network stack user configuration and
relevant permission to allow access to its data, as the network stack
is a privileged app.

Test: m -j passed
Change-Id: I6eab528714df6a17aae0cb546dcc3ad4bb21deea
2019-03-19 11:42:11 +09:00
Luke Huang
524f25ebb0 Add sepolicy for resolver service
Bug: 126141549
Test: built, flashed, booted
Change-Id: I34260e1e5cc238fbe92574f928252680c1e6b417
2019-03-05 15:49:33 +00:00
Remi NGUYEN VAN
780fbadf08 Add NetworkStack policies for netd and netlink
Allow netd to send network events to the NetworkStack, and allow the
NetworkStack to interact with netlink_route_socket for neighbor
monitoring.

Test: built, booted, WiFi works, no more violations
Bug: 112869080
Change-Id: If212b2897e37e9d249f81ba8139461bce461528e
2019-01-28 14:40:52 +09:00
Remi NGUYEN VAN
fd758cbddb Allow NetworkStack to find the telephony service
The network stack needs access to TelephonyManager#getAllCellInfo to
send network conditions broadcasts.

Bug: 122843997
Test: Flashed, verified violation not shown and cell info obtained
properly.

Change-Id: I6ef2858c9a2d1fbbb993164a93bd985e0eee8887
2019-01-15 16:57:32 +09:00
Remi NGUYEN VAN
d0f65ce2ff Allow network_stack to use common app api services
Bug: b/122620633
Test: m
Change-Id: I36fe66fc22a1664f9ef25c66f933a2613a6f346b
2019-01-11 07:48:21 +09:00
Remi NGUYEN VAN
5f3ba92c61 sepolicy changes for network stack app
The networking stack app hosts services that used to be in the system
server (IpClient, NetworkMonitor for now), but in a different process to
be packaged as a mainline module.

Test: booted, verified networking stack working when in app
Change-Id: I300a556f51b35c17378af961cea1ec937444e597
2018-12-20 12:05:31 +09:00