tim.tm_lin | e5976c1 | 2014-05-16 14:41:26 +0800 | [diff] [blame] | 1 | # Network utilities (radio process) |
| 2 | type netmgrd, domain; |
| 3 | type netmgrd_exec, exec_type, file_type; |
| 4 | |
| 5 | # Started by init |
| 6 | init_daemon_domain(netmgrd) |
| 7 | |
| 8 | # Triggers a sys_module denial, but kernel has CONFIG_MODULES=n. |
| 9 | dontaudit netmgrd self:capability sys_module; |
| 10 | |
| 11 | # Starts as (root,radio) changes to (radio,radio) |
| 12 | allow netmgrd self:capability { setuid setgid net_admin net_raw }; |
| 13 | |
| 14 | allow netmgrd self:udp_socket { create ioctl }; |
| 15 | # rawip_socket for iptables |
| 16 | allow netmgrd self:rawip_socket create_socket_perms; |
| 17 | allow netmgrd self:netlink_socket create_socket_perms; |
| 18 | allow netmgrd self:netlink_route_socket { create_socket_perms nlmsg_write nlmsg_read }; |
| 19 | |
| 20 | # Talk to qmuxd (qmux_radio) |
| 21 | qmux_socket(netmgrd) |
| 22 | |
| 23 | # Runs commands via sh. |
| 24 | allow netmgrd shell_exec:file rx_file_perms; |
| 25 | |
| 26 | # Runs /system/bin/ip addr flush dev <device> commands. |
| 27 | allow netmgrd system_file:file rx_file_perms; |
| 28 | |
| 29 | # Talk to init over the property socket |
| 30 | unix_socket_connect(netmgrd, property, init) |
| 31 | # Set net.rmnet0.* values |
| 32 | allow netmgrd radio_prop:property_service set; |
Nick Kralevich | ca7b261 | 2014-06-20 17:18:21 -0700 | [diff] [blame] | 33 | auditallow netmgrd radio_prop:property_service set; |
| 34 | allow netmgrd net_radio_prop:property_service set; |
tim.tm_lin | e5976c1 | 2014-05-16 14:41:26 +0800 | [diff] [blame] | 35 | |
| 36 | # Access to /proc/sys/net/* |
| 37 | allow netmgrd proc_net:file write; |
terry.cr_huang | 16cbc41 | 2014-09-16 16:57:20 +0800 | [diff] [blame] | 38 | |
| 39 | # Let netmgrd access /dev/mdm node (modem driver) |
| 40 | allow netmgrd radio_device:chr_file r_file_perms; |