| commit | 3ddaa63bde607d7f980046dd6ee074a0f267a044 | [log] [tgz] |
|---|---|---|
| author | Nick Kralevich <nnk@google.com> | Thu Nov 15 10:32:45 2018 -0800 |
| committer | Nick Kralevich <nnk@google.com> | Thu Nov 15 10:32:45 2018 -0800 |
| tree | 53faaf3c307060a87892dc1560f4a8a7667cd274 | |
| parent | 7ef01c34ed87ea81986d2669c77b59777523381f [diff] |
racoon: allow ioctl TUNSETIFF Used by https://android.googlesource.com/platform/external/ipsec-tools/+/bf16586a33b1432a11526754523fceb62944dc1c/main.c#116 Addresses the following denial: audit(0.0:8126): avc: denied { ioctl } for comm="racoon" path="/dev/tun" dev="tmpfs" ino=25329 ioctlcmd=0x54ca scontext=u:r:racoon:s0 tcontext=u:object_r:tun_device:s0 tclass=chr_file permissive=0 Test: policy compiles. Change-Id: Ia26077d4a9e810c7006d4b979d6b7e9ca154b485
diff --git a/public/racoon.te b/public/racoon.te index 7d1247a..6888740 100644 --- a/public/racoon.te +++ b/public/racoon.te
@@ -10,6 +10,7 @@ binder_use(racoon) allow racoon tun_device:chr_file r_file_perms; +allowxperm racoon tun_device:chr_file ioctl TUNSETIFF; allow racoon cgroup:dir { add_name create }; allow racoon kernel:system module_request;