Merge "Grant TUNGETIFF ioctl and revoke SIOCGIFFLAGS ioctl to vmnic" into main
diff --git a/private/vmnic.te b/private/vmnic.te
index da1aebb..1b7e0d8 100644
--- a/private/vmnic.te
+++ b/private/vmnic.te
@@ -13,13 +13,13 @@
# Let the vmnic domain use Binder.
binder_use(vmnic)
- # Allow for creating TAP network interfaces.
+ # Allow for creating and deleting TAP network interfaces.
allow vmnic self:global_capability_class_set net_admin;
allow vmnic self:tun_socket create_socket_perms_no_ioctl;
allow vmnic tun_device:chr_file rw_file_perms;
- allowxperm vmnic tun_device:chr_file ioctl { TUNSETIFF TUNSETPERSIST };
+ allowxperm vmnic tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF TUNSETPERSIST };
allow vmnic self:udp_socket create_socket_perms;
- allowxperm vmnic self:udp_socket ioctl { SIOCGIFFLAGS SIOCSIFFLAGS };
+ allowxperm vmnic self:udp_socket ioctl SIOCSIFFLAGS;
# Only virtualizationservice can communicate to vmnic
neverallow { domain -virtualizationservice -servicemanager } vmnic:binder call;