| # General definitions |
| type ipacm, domain; |
| type ipacm-diag, domain; |
| type ipacm_exec, exec_type, file_type; |
| type ipacm-diag_exec, exec_type, file_type; |
| init_daemon_domain(ipacm) |
| init_daemon_domain(ipacm-diag) |
| |
| # associate netdomain to use for accessing internet sockets |
| net_domain(ipacm) |
| |
| userdebug_or_eng(` |
| # Allow using the logging file between ipacm and ipacm-diag |
| unix_socket_send(ipacm, ipacm, ipacm-diag) |
| ') |
| |
| # Allow capabilities to perform network operations and interactions with network interfaces |
| allow ipacm ipacm:capability net_admin; |
| |
| # Allow operations with /dev/ipa, /dev/wwan_ioctl and /dev/ipaNatTable |
| allow ipacm ipa_dev:chr_file rw_file_perms; |
| |
| # Allow receiving NETLINK messages |
| allow ipacm ipacm:{ |
| netlink_route_socket |
| netlink_socket |
| # Allow querying the network stack via IOCTLs |
| udp_socket |
| } create_socket_perms; |
| |
| # Allow creating and modifying the PID file |
| allow ipacm ipacm_data_file:dir w_dir_perms; |
| allow ipacm ipacm_data_file:file create_file_perms; |