| Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 1 | # Network types |
| 2 | type node, node_type; |
| 3 | type netif, netif_type; |
| 4 | type port, port_type; |
| Stephen Smalley | ca0759b | 2013-09-30 15:07:55 -0400 | [diff] [blame] | 5 | |
| 6 | # Use network sockets. |
| Stephen Smalley | 85708ec | 2014-02-24 10:48:03 -0500 | [diff] [blame] | 7 | allow netdomain self:tcp_socket create_stream_socket_perms; |
| 8 | allow netdomain self:{ udp_socket rawip_socket } create_socket_perms; |
| Stephen Smalley | ca0759b | 2013-09-30 15:07:55 -0400 | [diff] [blame] | 9 | # Connect to ports. |
| 10 | allow netdomain port_type:tcp_socket name_connect; |
| 11 | # Bind to ports. |
| 12 | allow netdomain node_type:{ tcp_socket udp_socket } node_bind; |
| 13 | allow netdomain port_type:udp_socket name_bind; |
| 14 | allow netdomain port_type:tcp_socket name_bind; |
| Stephen Smalley | 85708ec | 2014-02-24 10:48:03 -0500 | [diff] [blame] | 15 | # See changes to the routing table. |
| Jeff Vander Stoep | 90ccbcf | 2016-04-26 11:29:14 -0700 | [diff] [blame] | 16 | allow netdomain self:netlink_route_socket { create read getattr write setattr lock append bind connect getopt setopt shutdown nlmsg_read }; |
| Stephen Smalley | ca0759b | 2013-09-30 15:07:55 -0400 | [diff] [blame] | 17 | |
| 18 | # Talks to netd via dnsproxyd socket. |
| 19 | unix_socket_connect(netdomain, dnsproxyd, netd) |
| Stephen Smalley | 96ff4c0 | 2014-02-24 13:04:49 -0500 | [diff] [blame] | 20 | |
| Sreeram Ramachandran | f74d781 | 2014-05-01 11:12:10 -0700 | [diff] [blame] | 21 | # Talks to netd via fwmarkd socket. |
| 22 | unix_socket_connect(netdomain, fwmarkd, netd) |
| 23 | |
| Stephen Smalley | 96ff4c0 | 2014-02-24 13:04:49 -0500 | [diff] [blame] | 24 | # Connect to mdnsd via mdnsd socket. |
| 25 | unix_socket_connect(netdomain, mdnsd, mdnsd) |