Add NetworkStack policies for netd and netlink
Allow netd to send network events to the NetworkStack, and allow the
NetworkStack to interact with netlink_route_socket for neighbor
monitoring.
Test: built, booted, WiFi works, no more violations
Bug: 112869080
Change-Id: If212b2897e37e9d249f81ba8139461bce461528e
diff --git a/private/netd.te b/private/netd.te
index 92b124f..0421d4a 100644
--- a/private/netd.te
+++ b/private/netd.te
@@ -16,3 +16,7 @@
# Allow netd to write to statsd.
unix_socket_send(netd, statsdw, statsd)
+
+# Allow netd to send callbacks to network_stack
+binder_call(netd, network_stack)
+
diff --git a/private/network_stack.te b/private/network_stack.te
index 9d2f2fb..4b88756 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -17,6 +17,9 @@
# The DhcpClient uses packet_sockets
allow network_stack self:packet_socket create_socket_perms_no_ioctl;
+# Monitor neighbors via netlink.
+allow network_stack self:netlink_route_socket nlmsg_write;
+
allow network_stack app_api_service:service_manager find;
allow network_stack netd_service:service_manager find;
allow network_stack radio_service:service_manager find;
diff --git a/public/netd.te b/public/netd.te
index 72d8483..a3e6464 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -144,7 +144,7 @@
# apps may not interact with netd over binder.
neverallow { appdomain -network_stack } netd:binder call;
-neverallow netd { appdomain userdebug_or_eng(`-su') }:binder call;
+neverallow netd { appdomain -network_stack userdebug_or_eng(`-su') }:binder call;
# persist.netd.stable_secret contains RFC 7217 secret key which should never be
# leaked to other processes. Make sure it never leaks.