Allow network_stack to synchronize the kernel rcu
via opening/closing a PF_KEY socket (this mirrors netd's privs)
Bug: 173167302
Test: m
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Ia2c2cb52c4ec9149db29dc86a7927e3432bd2b9b
diff --git a/private/network_stack.te b/private/network_stack.te
index 4768538..ab5a56e 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -40,3 +40,7 @@
allow network_stack fs_bpf:dir search;
allow network_stack fs_bpf:file { read write };
allow network_stack bpfloader:bpf { map_read map_write prog_run };
+
+# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
+# TODO: Remove this permission when 4.9 kernel is deprecated.
+allow network_stack self:key_socket create;