remove /proc/net read access from domain.te
SELinux domains wanting read access to /proc/net need to
explicitly declare it.
TODO: fixup the ListeningPortsTest cts test so that it's not
broken.
Bug: 9496886
Change-Id: Ia9f1214348ac4051542daa661d35950eb271b2e4
diff --git a/app.te b/app.te
index 47c05ac..cfb13b9 100644
--- a/app.te
+++ b/app.te
@@ -83,6 +83,7 @@
allow appdomain shell_data_file:file { write getattr };
# Write to /proc/net/xt_qtaguid/ctrl file.
+allow appdomain proc_net:dir search;
allow appdomain qtaguid_proc:file rw_file_perms;
# Everybody can read the xt_qtaguid resource tracking misc dev.
# So allow all apps to read from /dev/xt_qtaguid.
diff --git a/clatd.te b/clatd.te
index 0371e14..0492f22 100644
--- a/clatd.te
+++ b/clatd.te
@@ -15,6 +15,7 @@
allow clatd netd:unix_stream_socket { read write };
allow clatd netd:unix_dgram_socket { read write };
+r_dir_file(clatd, proc_net)
allow clatd self:capability { net_admin net_raw setuid setgid };
allow clatd self:netlink_route_socket nlmsg_write;
diff --git a/dhcp.te b/dhcp.te
index 32a6ccc..898e3a1 100644
--- a/dhcp.te
+++ b/dhcp.te
@@ -12,7 +12,8 @@
allow dhcp shell_exec:file rx_file_perms;
allow dhcp system_file:file rx_file_perms;
# For /proc/sys/net/ipv4/conf/*/promote_secondaries
-allow dhcp proc_net:file write;
+allow dhcp proc_net:file rw_file_perms;
+allow dhcp proc_net:dir r_dir_perms;
allow dhcp dhcp_prop:property_service set;
allow dhcp pan_result_prop:property_service set;
unix_socket_connect(dhcp, property, init)
diff --git a/domain.te b/domain.te
index a184e06..08aa4c1 100644
--- a/domain.te
+++ b/domain.te
@@ -145,7 +145,6 @@
r_dir_file(domain, sysfs_devices_system_cpu)
r_dir_file(domain, inotify)
r_dir_file(domain, cgroup)
-r_dir_file(domain, proc_net)
allow domain proc_cpuinfo:file r_file_perms;
# debugfs access
diff --git a/dumpstate.te b/dumpstate.te
index 5f65eb0..2324c25 100644
--- a/dumpstate.te
+++ b/dumpstate.te
@@ -60,6 +60,7 @@
allow dumpstate sysfs:file w_file_perms;
# Other random bits of data we want to collect
+allow dumpstate proc_net:dir search;
allow dumpstate qtaguid_proc:file r_file_perms;
allow dumpstate debugfs:file r_file_perms;
diff --git a/init.te b/init.te
index 4ec07f7..362f4f8 100644
--- a/init.te
+++ b/init.te
@@ -123,7 +123,8 @@
allow init proc:file w_file_perms;
# Write to /proc/sys/net/ping_group_range and other /proc/sys/net files.
-allow init proc_net:file w_file_perms;
+allow init proc_net:file rw_file_perms;
+allow init proc_net:dir r_dir_perms;
allow init self:capability net_admin;
# Write to /proc/sysrq-trigger.
diff --git a/mediaserver.te b/mediaserver.te
index ec69aed..6e6c87d 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -61,6 +61,7 @@
allow mediaserver audio_data_file:file create_file_perms;
# Read/[write] to /proc/net/xt_qtaguid/ctrl and /dev/xt_qtaguid
+allow mediaserver proc_net:dir search;
allow mediaserver qtaguid_proc:file rw_file_perms;
allow mediaserver qtaguid_device:chr_file r_file_perms;
diff --git a/netd.te b/netd.te
index ce89421..611ec76 100644
--- a/netd.te
+++ b/netd.te
@@ -23,7 +23,8 @@
allow netd devpts:chr_file rw_file_perms;
# For /proc/sys/net/ipv[46]/route/flush.
-allow netd proc_net:file write;
+allow netd proc_net:file rw_file_perms;
+allow netd proc_net:dir r_dir_perms;
# For /sys/modules/bcmdhd/parameters/firmware_path
# XXX Split into its own type.
diff --git a/radio.te b/radio.te
index d369949..2b63cd9 100644
--- a/radio.te
+++ b/radio.te
@@ -17,6 +17,7 @@
allow radio alarm_device:chr_file rw_file_perms;
+r_dir_file(radio, proc_net)
allow radio net_data_file:dir search;
allow radio net_data_file:file r_file_perms;
diff --git a/system_server.te b/system_server.te
index 6199eb7..45c4936 100644
--- a/system_server.te
+++ b/system_server.te
@@ -91,6 +91,7 @@
# Read/Write to /proc/net/xt_qtaguid/ctrl and and /dev/xt_qtaguid.
allow system_server qtaguid_proc:file rw_file_perms;
allow system_server qtaguid_device:chr_file rw_file_perms;
+r_dir_file(system_server, proc_net)
# Write to /proc/sysrq-trigger.
allow system_server proc_sysrq:file rw_file_perms;