blob: c7ed94d18f13cec725b3f616ae20ba1820c34d34 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
|
net_domain(netmgrd)
# Grant access to Qualcomm MSM Interface (QMI) radio sockets
qmux_socket(netmgrd)
wakelock_use(netmgrd)
# create socket in /dev/socket/netmgrd/
allow netmgrd netmgrd_socket:dir rw_dir_perms;
allow netmgrd netmgrd_socket:sock_file create_file_perms;
# communicate with netd
unix_socket_connect(netmgrd, netd, netd)
allow netmgrd proc_net:file rw_file_perms;
allow netmgrd self:capability { net_admin net_raw setgid setpcap setuid };
# read /data/misc/net
allow netmgrd net_data_file:dir r_dir_perms;
allow netmgrd net_data_file:file r_file_perms;
# read and write /data/misc/netmgr
userdebug_or_eng(`
allow netmgrd netmgr_data_file:dir rw_dir_perms;
allow netmgrd netmgr_data_file:file create_file_perms;
')
# execute shell, ip, and toolbox
allow netmgrd vendor_shell_exec:file rx_file_perms;
allow netmgrd vendor_toolbox_exec:file rx_file_perms;
# netmgrd sockets
allow netmgrd self:netlink_route_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write };
allow netmgrd self:netlink_socket create_socket_perms_no_ioctl;
allow netmgrd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write };
allow netmgrd self:rawip_socket create_socket_perms_no_ioctl;
allow netmgrd self:socket create_socket_perms;
# in addition to ioctl commands granted to domain allow netmgrd to use:
allowxperm netmgrd self:udp_socket ioctl priv_sock_ioctls;
allowxperm netmgrd self:socket ioctl msm_sock_ipc_ioctls;
set_prop(netmgrd, net_radio_prop)
# read files in /sys
r_dir_file(netmgrd, sysfs_type)
allow netmgrd sysfs_net:file write;
userdebug_or_eng(`
allow netmgrd diag_device:chr_file rw_file_perms;
')
# For netmgrd to be able to execute netutils wrappers
domain_trans(netmgrd, netutils_wrapper_exec, netutils_wrapper)
allow netmgrd netutils_wrapper_exec:file { open read getattr execute };
allow netmgrd netutils_wrapper:process sigkill;
|
