a3c97a7660
When the toolbox domain was introduced, we allowed all domains to exec it to avoid breakage. However, only domains that were previously allowed the ability to exec /system files would have been able to do this prior to the introduction of the toolbox domain. Remove the rule from domain.te and add rules to all domains that are already allowed execute_no_trans to system_file. Requires coordination with device-specific policy changes with the same Change-Id. Change-Id: Ie46209f0412f9914857dc3d7c6b0917b7031aae5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
31 lines
1.2 KiB
Text
31 lines
1.2 KiB
Text
type dhcp, domain;
|
|
type dhcp_exec, exec_type, file_type;
|
|
type dhcp_data_file, file_type, data_file_type;
|
|
|
|
init_daemon_domain(dhcp)
|
|
net_domain(dhcp)
|
|
|
|
allow dhcp cgroup:dir { create write add_name };
|
|
allow dhcp self:capability { setgid setuid net_admin net_raw net_bind_service };
|
|
allow dhcp self:packet_socket create_socket_perms;
|
|
allow dhcp self:netlink_route_socket nlmsg_write;
|
|
allow dhcp shell_exec:file rx_file_perms;
|
|
allow dhcp system_file:file rx_file_perms;
|
|
# XXX Run toolbox. Might not be needed.
|
|
allow dhcp toolbox_exec:file rx_file_perms;
|
|
auditallow dhcp toolbox_exec:file rx_file_perms;
|
|
# For /proc/sys/net/ipv4/conf/*/promote_secondaries
|
|
allow dhcp proc_net:file write;
|
|
|
|
set_prop(dhcp, dhcp_prop)
|
|
set_prop(dhcp, pan_result_prop)
|
|
|
|
type_transition dhcp system_data_file:{ dir file } dhcp_data_file;
|
|
allow dhcp dhcp_data_file:dir create_dir_perms;
|
|
allow dhcp dhcp_data_file:file create_file_perms;
|
|
|
|
# PAN connections
|
|
allow dhcp netd:fd use;
|
|
allow dhcp netd:fifo_file rw_file_perms;
|
|
allow dhcp netd:{ dgram_socket_class_set unix_stream_socket } { read write };
|
|
allow dhcp netd:{ netlink_kobject_uevent_socket netlink_route_socket netlink_nflog_socket } { read write };
|