Permit bluetooth to run DhcpClient
Requires net_raw and net_bind_service.
Bug: 26991160
Change-Id: I4cdd23f0d0c94c9b5126c821464aadc67cdb90c9
diff --git a/bluetooth.te b/bluetooth.te
index 6a329b7..1817820 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -24,6 +24,8 @@
allow bluetooth self:capability2 wake_alarm;
# tethering
+allow bluetooth self:packet_socket create_socket_perms;
+allow bluetooth self:capability { net_admin net_raw net_bind_service };
allow bluetooth self:tun_socket create_socket_perms;
allow bluetooth efs_file:dir search;
@@ -59,6 +61,6 @@
###
# Superuser capabilities.
-# bluetooth requires net_admin, wake_alarm and block_suspend
-neverallow bluetooth self:capability ~net_admin;
+# bluetooth requires net_{admin,raw,bind_service} and wake_alarm and block_suspend.
+neverallow bluetooth self:capability ~{ net_admin net_raw net_bind_service };
neverallow bluetooth self:capability2 ~{ wake_alarm block_suspend };
diff --git a/netd.te b/netd.te
index 2c0fb15..3c612a4 100644
--- a/netd.te
+++ b/netd.te
@@ -30,15 +30,6 @@
# XXX Split into its own type.
allow netd sysfs:file write;
-# Set dhcp lease for PAN connection
-set_prop(netd, dhcp_prop)
-set_prop(netd, system_prop)
-auditallow netd system_prop:property_service set;
-
-# Connect to PAN
-domain_auto_trans(netd, dhcp_exec, dhcp)
-allow netd dhcp:process signal;
-
# Needed to update /data/misc/wifi/hostapd.conf
# TODO: See what we can do to reduce the need for
# these capabilities