Avijit Kanti Das | 353e929 | 2014-07-23 23:39:30 -0700 | [diff] [blame] | 1 | type netmgrd, domain; |
| 2 | type netmgrd_exec, exec_type, file_type; |
| 3 | net_domain(netmgrd) |
| 4 | init_daemon_domain(netmgrd) |
Subash Abhinov Kasiviswanathan | 1b307e7 | 2014-03-04 11:09:42 -0700 | [diff] [blame] | 5 | |
| 6 | userdebug_or_eng(` |
Shruthi Krishna | f1b38f7 | 2014-07-25 16:21:53 -0700 | [diff] [blame] | 7 | domain_auto_trans(shell, netmgrd_exec, netmgrd) |
| 8 | domain_auto_trans(adbd, netmgrd_exec, netmgrd) |
Subash Abhinov Kasiviswanathan | 1b307e7 | 2014-03-04 11:09:42 -0700 | [diff] [blame] | 9 | ') |
Avijit Kanti Das | 353e929 | 2014-07-23 23:39:30 -0700 | [diff] [blame] | 10 | |
| 11 | #Allow files to be written during the operation of netmgrd |
| 12 | file_type_auto_trans(netmgrd, system_data_file, data_test_data_file) |
| 13 | |
| 14 | #Allow netmgrd operations |
Subash Abhinov Kasiviswanathan | 4e2e5af | 2014-10-16 13:37:05 -0600 | [diff] [blame] | 15 | allow netmgrd netmgrd:capability { dac_override net_raw net_admin sys_module fsetid setgid setuid setpcap }; |
Avijit Kanti Das | 353e929 | 2014-07-23 23:39:30 -0700 | [diff] [blame] | 16 | |
| 17 | #Allow access to kernel modules |
| 18 | allow netmgrd kernel:system { module_request }; |
| 19 | |
| 20 | #Allow logging |
| 21 | allow netmgrd diag_device:chr_file { rw_file_perms }; |
| 22 | allow netmgrd smem_log_device:chr_file { rw_file_perms }; |
| 23 | |
| 24 | #Allow operations on different types of sockets |
| 25 | allow netmgrd netmgrd:rawip_socket { create getopt setopt write }; |
| 26 | allow netmgrd netmgrd:netlink_xfrm_socket { create bind }; |
| 27 | allow netmgrd netmgrd:netlink_socket { write read create bind }; |
| 28 | allow netmgrd netmgrd:socket { create ioctl }; |
| 29 | allow netmgrd netmgrd:netlink_route_socket { setopt getattr write nlmsg_write }; |
| 30 | allow netmgrd init:unix_stream_socket { connectto }; |
Avijit Kanti Das | fe61c2d | 2014-10-16 20:17:03 -0700 | [diff] [blame] | 31 | allow netmgrd property_socket:sock_file write; |
Avijit Kanti Das | 353e929 | 2014-07-23 23:39:30 -0700 | [diff] [blame] | 32 | |
Biswajit Paul | 64f83f6 | 2014-10-13 14:36:16 -0700 | [diff] [blame] | 33 | qmux_socket(netmgrd); |
Avijit Kanti Das | 353e929 | 2014-07-23 23:39:30 -0700 | [diff] [blame] | 34 | |
| 35 | #Allow writing of ipv6 network properties |
| 36 | allow netmgrd proc_net:file { write }; |
| 37 | |
Subash Abhinov Kasiviswanathan | 1b307e7 | 2014-03-04 11:09:42 -0700 | [diff] [blame] | 38 | #Allow address configuration |
| 39 | allow netmgrd system_prop:property_service { set }; |
| 40 | |
Subash Abhinov Kasiviswanathan | 4e2e5af | 2014-10-16 13:37:05 -0600 | [diff] [blame] | 41 | #Allow setting of DNS and GW Android properties |
| 42 | allow netmgrd net_radio_prop:property_service { set }; |
| 43 | |
Avijit Kanti Das | 353e929 | 2014-07-23 23:39:30 -0700 | [diff] [blame] | 44 | #Allow execution of commands in shell |
| 45 | allow netmgrd system_file:file { execute_no_trans }; |
Avijit Kanti Das | f91f2ba | 2014-09-24 17:08:13 -0700 | [diff] [blame] | 46 | |
Biswajit Paul | d8ab626 | 2014-10-23 16:27:42 -0700 | [diff] [blame] | 47 | allow netmgrd self:socket create_socket_perms; |
Avijit Kanti Das | fe61c2d | 2014-10-16 20:17:03 -0700 | [diff] [blame] | 48 | allow netmgrd sysfs_esoc:dir r_dir_perms; |
Avijit Kanti Das | f91f2ba | 2014-09-24 17:08:13 -0700 | [diff] [blame] | 49 | |
| 50 | #Allow communication with netd |
| 51 | allow netmgrd netd_socket:sock_file write; |
Subash Abhinov Kasiviswanathan | 4e2e5af | 2014-10-16 13:37:05 -0600 | [diff] [blame] | 52 | |
| 53 | #Allow nemtgrd to use esoc api's to determine target |
Avijit Kanti Das | fe61c2d | 2014-10-16 20:17:03 -0700 | [diff] [blame] | 54 | allow netmgrd shell_exec:file { execute r_file_perms execute_no_trans }; |
| 55 | allow netmgrd sysfs_esoc:lnk_file read; |
Avijit Kanti Das | d01b3b3 | 2014-10-21 10:30:09 -0700 | [diff] [blame] | 56 | |
| 57 | r_dir_file(netmgrd, sysfs_ssr); |