[Thread] allow ot-daemon to read/write system_server created UDP socket
This is similar to the rawip_socket but it's UDP socket here. The use
case is to allow the ot-daemon being the DNS server for the Thread
network which needs to bind to port 53. The ot-daemon service won't bind
the port itself as it's an unprivileged process, instead, the
system_server will create the socket for it.
Bug: 379998097
Test: Tested with cuttlefish
Change-Id: I414a36696e5a219ad932289f5eade02652b4ecc6
diff --git a/private/ot_daemon.te b/private/ot_daemon.te
index 2fc74b5..04cb70f 100644
--- a/private/ot_daemon.te
+++ b/private/ot_daemon.te
@@ -26,6 +26,9 @@
# Allow OT daemon to read/write on the socket created by System Server
allow ot_daemon system_server:rawip_socket rw_socket_perms_no_ioctl;
+# Allow OT daemon to read/write on the UDP sockets created by system server
+allow ot_daemon system_server:udp_socket rw_socket_perms;
+
hal_client_domain(ot_daemon, hal_threadnetwork)
# Only ot_daemon can publish the binder service