Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 1 | # network manager |
Stephen Smalley | 45731c7 | 2014-09-08 16:06:40 -0400 | [diff] [blame] | 2 | type netd, domain, mlstrustedsubject; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 3 | type netd_exec, exec_type, file_type; |
| 4 | |
| 5 | init_daemon_domain(netd) |
Nick Kralevich | bc19050 | 2013-12-15 19:04:09 -0800 | [diff] [blame] | 6 | net_domain(netd) |
| 7 | |
Stephen Smalley | d581b81 | 2014-02-24 13:00:59 -0500 | [diff] [blame] | 8 | allow netd self:capability { net_admin net_raw kill }; |
| 9 | # Note: fsetid is deliberately not included above. fsetid checks are |
| 10 | # triggered by chmod on a directory or file owned by a group other |
| 11 | # than one of the groups assigned to the current process to see if |
| 12 | # the setgid bit should be cleared, regardless of whether the setgid |
| 13 | # bit was even set. We do not appear to truly need this capability |
Nick Kralevich | 8d20081 | 2015-04-02 15:36:51 -0700 | [diff] [blame] | 14 | # for netd to operate. |
| 15 | dontaudit netd self:capability fsetid; |
Stephen Smalley | d581b81 | 2014-02-24 13:00:59 -0500 | [diff] [blame] | 16 | |
Stephen Smalley | 1601132 | 2014-02-24 15:06:11 -0500 | [diff] [blame] | 17 | allow netd self:netlink_kobject_uevent_socket create_socket_perms; |
| 18 | allow netd self:netlink_route_socket nlmsg_write; |
| 19 | allow netd self:netlink_nflog_socket create_socket_perms; |
Jeff Sharkey | 33bf053 | 2014-12-16 13:08:16 -0800 | [diff] [blame] | 20 | allow netd self:netlink_socket create_socket_perms; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 21 | allow netd shell_exec:file rx_file_perms; |
| 22 | allow netd system_file:file x_file_perms; |
| 23 | allow netd devpts:chr_file rw_file_perms; |
| 24 | |
| 25 | # For /proc/sys/net/ipv[46]/route/flush. |
Nick Kralevich | 5cf3994 | 2015-02-25 13:28:40 -0800 | [diff] [blame] | 26 | allow netd proc_net:file write; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 27 | |
| 28 | # For /sys/modules/bcmdhd/parameters/firmware_path |
| 29 | # XXX Split into its own type. |
| 30 | allow netd sysfs:file write; |
| 31 | |
| 32 | # Set dhcp lease for PAN connection |
William Roberts | 2f5a6a9 | 2015-05-04 18:22:45 -0700 | [diff] [blame] | 33 | set_prop(netd, dhcp_prop) |
| 34 | set_prop(netd, system_prop) |
Stephen Smalley | fee4915 | 2014-06-19 10:27:02 -0400 | [diff] [blame] | 35 | auditallow netd system_prop:property_service set; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 36 | |
| 37 | # Connect to PAN |
Stephen Smalley | 9de4c69 | 2013-04-04 11:31:00 -0400 | [diff] [blame] | 38 | domain_auto_trans(netd, dhcp_exec, dhcp) |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 39 | allow netd dhcp:process signal; |
| 40 | |
| 41 | # Needed to update /data/misc/wifi/hostapd.conf |
| 42 | # TODO: See what we can do to reduce the need for |
| 43 | # these capabilities |
| 44 | allow netd self:capability { dac_override chown fowner }; |
| 45 | allow netd wifi_data_file:file create_file_perms; |
| 46 | allow netd wifi_data_file:dir rw_dir_perms; |
| 47 | |
Sreeram Ramachandran | 65edb75 | 2014-07-07 22:04:57 -0700 | [diff] [blame] | 48 | # Needed to update /data/misc/net/rt_tables |
| 49 | allow netd net_data_file:file create_file_perms; |
| 50 | allow netd net_data_file:dir rw_dir_perms; |
| 51 | |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 52 | # Allow netd to spawn hostapd in it's own domain |
| 53 | domain_auto_trans(netd, hostapd_exec, hostapd) |
| 54 | allow netd hostapd:process signal; |
| 55 | |
| 56 | # Allow netd to spawn dnsmasq in it's own domain |
| 57 | domain_auto_trans(netd, dnsmasq_exec, dnsmasq) |
| 58 | allow netd dnsmasq:process signal; |
| 59 | |
Lorenzo Colitti | ab7dfab | 2013-08-05 15:32:56 +0900 | [diff] [blame] | 60 | # Allow netd to start clatd in its own domain |
| 61 | domain_auto_trans(netd, clatd_exec, clatd) |
| 62 | allow netd clatd:process signal; |
| 63 | |
William Roberts | 2f5a6a9 | 2015-05-04 18:22:45 -0700 | [diff] [blame] | 64 | set_prop(netd, ctl_mdnsd_prop) |
Nick Kralevich | 9a19885 | 2013-07-12 21:28:41 -0700 | [diff] [blame] | 65 | |
Sreeram Ramachandran | 56ecf4b | 2014-05-01 11:12:10 -0700 | [diff] [blame] | 66 | # Allow netd to operate on sockets that are passed to it. |
| 67 | allow netd netdomain:{tcp_socket udp_socket rawip_socket dccp_socket tun_socket} {read write getattr setattr getopt setopt}; |
| 68 | allow netd netdomain:fd use; |
| 69 | |
Nick Kralevich | 9a19885 | 2013-07-12 21:28:41 -0700 | [diff] [blame] | 70 | ### |
| 71 | ### Neverallow rules |
| 72 | ### |
| 73 | ### netd should NEVER do any of this |
| 74 | |
| 75 | # Block device access. |
| 76 | neverallow netd dev_type:blk_file { read write }; |
| 77 | |
Nick Kralevich | 9a19885 | 2013-07-12 21:28:41 -0700 | [diff] [blame] | 78 | # ptrace any other app |
| 79 | neverallow netd { domain }:process ptrace; |
| 80 | |
| 81 | # Write to /system. |
| 82 | neverallow netd system_file:dir_file_class_set write; |
| 83 | |
| 84 | # Write to files in /data/data or system files on /data |
| 85 | neverallow netd { app_data_file system_data_file }:dir_file_class_set write; |