623975fa5a
Permissive domains are only intended for development. When a device launches, we want to ensure that all permissive domains are in, at a minimum, unconfined+enforcing. Add FORCE_PERMISSIVE_TO_UNCONFINED to Android.mk. During development, this flag is false, and permissive domains are allowed. When SELinux new feature development has been frozen immediately before release, this flag will be flipped to true. Any previously permissive domains will move into unconfined+enforcing. This will ensure that all SELinux domains have at least a minimal level of protection. Unconditionally enable this flag for all user builds. Change-Id: I1632f0da0022c80170d8eb57c82499ac13fd7858
29 lines
1.1 KiB
Text
29 lines
1.1 KiB
Text
type dhcp, domain;
|
|
permissive_or_unconfined(dhcp)
|
|
type dhcp_exec, exec_type, file_type;
|
|
type dhcp_data_file, file_type, data_file_type;
|
|
|
|
init_daemon_domain(dhcp)
|
|
net_domain(dhcp)
|
|
|
|
allow dhcp cgroup:dir { create write add_name };
|
|
allow dhcp self:capability { setgid setuid net_admin net_raw net_bind_service };
|
|
allow dhcp self:packet_socket create_socket_perms;
|
|
allow dhcp self:netlink_route_socket { create_socket_perms nlmsg_write };
|
|
allow dhcp shell_exec:file rx_file_perms;
|
|
allow dhcp system_file:file rx_file_perms;
|
|
# For /proc/sys/net/ipv4/conf/*/promote_secondaries
|
|
allow dhcp proc_net:file write;
|
|
allow dhcp system_prop:property_service set ;
|
|
unix_socket_connect(dhcp, property, init)
|
|
allow dhcp owntty_device:chr_file rw_file_perms;
|
|
|
|
type_transition dhcp system_data_file:{ dir file } dhcp_data_file;
|
|
allow dhcp dhcp_data_file:dir create_dir_perms;
|
|
allow dhcp dhcp_data_file:file create_file_perms;
|
|
|
|
# PAN connections
|
|
allow dhcp netd:fd use;
|
|
allow dhcp netd:fifo_file rw_file_perms;
|
|
allow dhcp netd:{ dgram_socket_class_set unix_stream_socket } { read write };
|
|
allow dhcp netd:{ netlink_kobject_uevent_socket netlink_route_socket netlink_nflog_socket } { read write };
|