Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 1 | # network manager |
| 2 | type netd, domain; |
| 3 | type netd_exec, exec_type, file_type; |
| 4 | |
| 5 | init_daemon_domain(netd) |
Geremy Condra | 3bb1ccc | 2013-09-16 14:53:41 -0700 | [diff] [blame^] | 6 | allow netd self:capability { net_admin net_raw kill fsetid }; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 7 | allow netd self:netlink_kobject_uevent_socket *; |
| 8 | allow netd self:netlink_route_socket *; |
| 9 | allow netd self:netlink_nflog_socket *; |
| 10 | allow netd self:rawip_socket *; |
| 11 | allow netd self:udp_socket *; |
| 12 | allow netd node:udp_socket node_bind; |
| 13 | allow netd port:udp_socket name_bind; |
| 14 | allow netd self:unix_stream_socket *; |
| 15 | allow netd shell_exec:file rx_file_perms; |
| 16 | allow netd system_file:file x_file_perms; |
| 17 | allow netd devpts:chr_file rw_file_perms; |
| 18 | |
| 19 | # For /proc/sys/net/ipv[46]/route/flush. |
| 20 | # XXX Split /proc/sys/net into its own type. |
| 21 | allow netd proc:file write; |
| 22 | |
| 23 | # For /sys/modules/bcmdhd/parameters/firmware_path |
| 24 | # XXX Split into its own type. |
| 25 | allow netd sysfs:file write; |
| 26 | |
| 27 | # Set dhcp lease for PAN connection |
| 28 | unix_socket_connect(netd, property, init) |
| 29 | allow netd system_prop:property_service set; |
| 30 | |
| 31 | # Connect to PAN |
Stephen Smalley | 9de4c69 | 2013-04-04 11:31:00 -0400 | [diff] [blame] | 32 | domain_auto_trans(netd, dhcp_exec, dhcp) |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 33 | allow netd dhcp:process signal; |
| 34 | |
| 35 | # Needed to update /data/misc/wifi/hostapd.conf |
| 36 | # TODO: See what we can do to reduce the need for |
| 37 | # these capabilities |
| 38 | allow netd self:capability { dac_override chown fowner }; |
| 39 | allow netd wifi_data_file:file create_file_perms; |
| 40 | allow netd wifi_data_file:dir rw_dir_perms; |
| 41 | |
| 42 | # Allow netd to spawn hostapd in it's own domain |
| 43 | domain_auto_trans(netd, hostapd_exec, hostapd) |
| 44 | allow netd hostapd:process signal; |
| 45 | |
| 46 | # Allow netd to spawn dnsmasq in it's own domain |
| 47 | domain_auto_trans(netd, dnsmasq_exec, dnsmasq) |
| 48 | allow netd dnsmasq:process signal; |
| 49 | |
Lorenzo Colitti | ab7dfab | 2013-08-05 15:32:56 +0900 | [diff] [blame] | 50 | # Allow netd to start clatd in its own domain |
| 51 | domain_auto_trans(netd, clatd_exec, clatd) |
| 52 | allow netd clatd:process signal; |
| 53 | |
Nick Kralevich | 4a13f78 | 2013-07-10 14:58:27 -0700 | [diff] [blame] | 54 | # Support netd running mdnsd |
| 55 | # TODO: prune this back further |
| 56 | allow netd ctl_default_prop:property_service set; |
| 57 | allow netd device:sock_file write; |
Nick Kralevich | 9a19885 | 2013-07-12 21:28:41 -0700 | [diff] [blame] | 58 | |
| 59 | ### |
| 60 | ### Neverallow rules |
| 61 | ### |
| 62 | ### netd should NEVER do any of this |
| 63 | |
| 64 | # Block device access. |
| 65 | neverallow netd dev_type:blk_file { read write }; |
| 66 | |
| 67 | # Kernel memory access. |
| 68 | neverallow netd kmem_device:chr_file { read write }; |
| 69 | |
| 70 | # Setting SELinux enforcing status or booleans. |
| 71 | # Conditionally allowed to system_app for SEAndroidManager. |
| 72 | neverallow netd kernel:security { setenforce setbool }; |
| 73 | |
| 74 | # Load security policy. |
| 75 | neverallow netd kernel:security load_policy; |
| 76 | |
| 77 | # ptrace any other app |
| 78 | neverallow netd { domain }:process ptrace; |
| 79 | |
| 80 | # Write to /system. |
| 81 | neverallow netd system_file:dir_file_class_set write; |
| 82 | |
| 83 | # Write to files in /data/data or system files on /data |
| 84 | neverallow netd { app_data_file system_data_file }:dir_file_class_set write; |