a3c97a7660
When the toolbox domain was introduced, we allowed all domains to exec it to avoid breakage. However, only domains that were previously allowed the ability to exec /system files would have been able to do this prior to the introduction of the toolbox domain. Remove the rule from domain.te and add rules to all domains that are already allowed execute_no_trans to system_file. Requires coordination with device-specific policy changes with the same Change-Id. Change-Id: Ie46209f0412f9914857dc3d7c6b0917b7031aae5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
35 lines
1,012 B
Text
35 lines
1,012 B
Text
# IKE key management daemon
|
|
type racoon, domain;
|
|
type racoon_exec, exec_type, file_type;
|
|
|
|
init_daemon_domain(racoon)
|
|
typeattribute racoon mlstrustedsubject;
|
|
|
|
net_domain(racoon)
|
|
|
|
binder_use(racoon)
|
|
|
|
allow racoon tun_device:chr_file r_file_perms;
|
|
allow racoon cgroup:dir { add_name create };
|
|
allow racoon kernel:system module_request;
|
|
|
|
allow racoon self:key_socket create_socket_perms;
|
|
allow racoon self:tun_socket create_socket_perms;
|
|
allow racoon self:capability { net_admin net_bind_service net_raw setuid };
|
|
|
|
# XXX: should we give ip-up-vpn its own label (currently racoon domain)
|
|
allow racoon system_file:file rx_file_perms;
|
|
# XXX Run toolbox. Might not be needed.
|
|
allow racoon toolbox_exec:file rx_file_perms;
|
|
auditallow racoon toolbox_exec:file rx_file_perms;
|
|
allow racoon vpn_data_file:file create_file_perms;
|
|
allow racoon vpn_data_file:dir w_dir_perms;
|
|
|
|
use_keystore(racoon)
|
|
|
|
# Racoon (VPN) has a restricted set of permissions from the default.
|
|
allow racoon keystore:keystore_key {
|
|
get
|
|
sign
|
|
verify
|
|
};
|