netutils_wrapper.te 1.7 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344
  1. typeattribute netutils_wrapper coredomain;
  2. r_dir_file(netutils_wrapper, system_file);
  3. # For netutils (ip, iptables, tc)
  4. allow netutils_wrapper self:global_capability_class_set net_raw;
  5. allow netutils_wrapper system_file:file { execute execute_no_trans };
  6. allow netutils_wrapper proc_net_type:file { open read getattr };
  7. allow netutils_wrapper self:rawip_socket create_socket_perms;
  8. allow netutils_wrapper self:udp_socket create_socket_perms;
  9. allow netutils_wrapper self:global_capability_class_set net_admin;
  10. # ip utils need everything but ioctl
  11. allow netutils_wrapper self:netlink_route_socket ~ioctl;
  12. allow netutils_wrapper self:netlink_xfrm_socket ~ioctl;
  13. # For netutils (ndc) to be able to talk to netd
  14. allow netutils_wrapper netd_service:service_manager find;
  15. allow netutils_wrapper dnsresolver_service:service_manager find;
  16. binder_use(netutils_wrapper);
  17. binder_call(netutils_wrapper, netd);
  18. # For vendor code that update the iptables rules at runtime. They need to reload
  19. # the whole chain including the xt_bpf rules. They need to access to the pinned
  20. # program when reloading the rule.
  21. allow netutils_wrapper fs_bpf:dir search;
  22. allow netutils_wrapper fs_bpf:file { read write };
  23. allow netutils_wrapper bpfloader:bpf prog_run;
  24. # For /data/misc/net access to ndc and ip
  25. r_dir_file(netutils_wrapper, net_data_file)
  26. domain_auto_trans({
  27. domain
  28. -coredomain
  29. -appdomain
  30. }, netutils_wrapper_exec, netutils_wrapper)
  31. # suppress spurious denials
  32. dontaudit netutils_wrapper self:global_capability_class_set sys_resource;
  33. dontaudit netutils_wrapper sysfs_type:file read;
  34. # netutils wrapper may only use the following capabilities.
  35. neverallow netutils_wrapper self:global_capability_class_set ~{ net_admin net_raw };