Update netlink_tcpdiag_socket for nlmsg xperm
Translate the netlink_tcpdiag_socket rules for the new extended permission.
This policy is updated to support kernel with or without the new nlmsg
permission.
For netd and network_stack, complete access is granted (as no allowxperm
rule is defined). It was not possible to determine the exact access
required by system_server so the full access is also granted.
Test: Boot and validate that no denials are reported.
Bug: 353255679
Change-Id: Ifc5b2ab7706a2873448bc32a83d1cad70fc207b6
diff --git a/private/network_stack.te b/private/network_stack.te
index 4450e02..ee7269e 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -55,7 +55,11 @@
get_prop(network_stack, device_config_connectivity_prop)
# Create/use netlink_tcpdiag_socket to get tcp info
-allow network_stack self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write };
+allow network_stack self:netlink_tcpdiag_socket create_socket_perms_no_ioctl;
+# For kernel < 6.13
+allow network_stack self:netlink_tcpdiag_socket { nlmsg_read nlmsg_write };
+# For kernel >= 6.13
+allow network_stack self:netlink_tcpdiag_socket nlmsg;
############### Tethering Service app - Tethering.apk ##############
hal_client_domain(network_stack, hal_tetheroffload)
# Create and share netlink_netfilter_sockets for tetheroffload.