Separate permissions to set WiFi related properties
wificond would like to be able to set WiFi related properties
without access to the rest of the system properties. Today,
this only involves marking the driver as loaded or unloaded.
avc: denied { write } for name="property_service" dev="tmpfs" ino=10100
scontext=u:r:wificond:s0 tcontext=u:object_r:property_socket:s0
tclass=sock_file permissive=0
Bug: 29579539
Test: No avc denials related to system properties across
various WiFi events.
Change-Id: I6d9f1de3fbef04cb7750cc3753634f9e02fdb71f
(cherry picked from commit 1ebfdd6a14fb21705664c8e144f151b39c3d73f8)
diff --git a/property_contexts b/property_contexts
index cd4068e..9190831 100644
--- a/property_contexts
+++ b/property_contexts
@@ -24,7 +24,6 @@
sys.powerctl u:object_r:powerctl_prop:s0
sys.usb.ffs. u:object_r:ffs_prop:s0
service. u:object_r:system_prop:s0
-wlan. u:object_r:system_prop:s0
dhcp. u:object_r:dhcp_prop:s0
dhcp.bt-pan.result u:object_r:pan_result_prop:s0
bluetooth. u:object_r:bluetooth_prop:s0
@@ -95,3 +94,6 @@
ro.config. u:object_r:config_prop:s0
dalvik. u:object_r:dalvik_prop:s0
ro.dalvik. u:object_r:dalvik_prop:s0
+
+# Shared between system server and wificond
+wlan. u:object_r:wifi_prop:s0