d8843d1c2e
Denial log:
1. 10-30 11:02:50.279 wifi 1119 1119 W HwBinder:1119_1:
type=1400 audit(0.0:113): avc: denied { transfer } for
scontext=u:r:wificond:s0 tcontext=u:r:keystore:s0
tclass=binder permissive=0
2. 01-15 16:24:04.214 W/keystore( 1007): type=1400
audit(0.0:109): avc: denied { call } for
scontext=u:r:keystore:s0 tcontext=u:r:wificond:s0
tclass=binder permissive=0
3. 01-16 12:11:19.704 W/keystore( 1021): type=1400
audit(0.0:163): avc: denied { transfer } for
scontext=u:r:keystore:s0 tcontext=u:r:wificond:s0
tclass=binder permissive=0
Bug: 143638513
Bug: 145310496
Test: Installed CA and wifi certificates and connects
to enterprise network.
No selinux denial seen from wificond and keystore.
Change-Id: I9727add13844b1ff1875e493b777e3a294e00ffa
42 lines
1.5 KiB
Text
42 lines
1.5 KiB
Text
# wificond
|
|
type wificond, domain;
|
|
type wificond_exec, system_file_type, exec_type, file_type;
|
|
|
|
binder_use(wificond)
|
|
binder_call(wificond, system_server)
|
|
binder_call(wificond, keystore)
|
|
|
|
add_service(wificond, wificond_service)
|
|
|
|
set_prop(wificond, exported_wifi_prop)
|
|
set_prop(wificond, wifi_prop)
|
|
set_prop(wificond, ctl_default_prop)
|
|
|
|
# create sockets to set interfaces up and down
|
|
allow wificond self:udp_socket create_socket_perms;
|
|
# setting interface state up/down is a privileged ioctl
|
|
allowxperm wificond self:udp_socket ioctl { SIOCSIFFLAGS SIOCSIFHWADDR };
|
|
allow wificond self:global_capability_class_set { net_admin net_raw };
|
|
# allow wificond to speak to nl80211 in the kernel
|
|
allow wificond self:netlink_socket create_socket_perms_no_ioctl;
|
|
# newer kernels (e.g. 4.4 but not 4.1) have a new class for sockets
|
|
allow wificond self:netlink_generic_socket create_socket_perms_no_ioctl;
|
|
|
|
r_dir_file(wificond, proc_net_type)
|
|
|
|
# allow wificond to check permission for dumping logs
|
|
allow wificond permission_service:service_manager find;
|
|
|
|
# dumpstate support
|
|
allow wificond dumpstate:fd use;
|
|
allow wificond dumpstate:fifo_file write;
|
|
|
|
#### Offer the Wifi Keystore HwBinder service ###
|
|
hwbinder_use(wificond)
|
|
get_prop(wificond, hwservicemanager_prop)
|
|
typeattribute wificond wifi_keystore_service_server;
|
|
add_hwservice(wificond, system_wifi_keystore_hwservice)
|
|
|
|
# Allow keystore binder access to serve the HwBinder service.
|
|
allow wificond keystore_service:service_manager find;
|
|
allow wificond keystore:keystore_key get;
|