| Sandeep Patil | c6d8902 | 2017-04-14 19:06:56 -0700 | [diff] [blame] | 1 | typeattribute netutils_wrapper coredomain; |
| 2 | |
| 3 | r_dir_file(netutils_wrapper, system_file); |
| 4 | |
| 5 | # For netutils (ip, iptables, tc) |
| Benjamin Gordon | 9b2e0cb | 2017-11-09 15:51:26 -0700 | [diff] [blame] | 6 | allow netutils_wrapper self:global_capability_class_set net_raw; |
| Sandeep Patil | c6d8902 | 2017-04-14 19:06:56 -0700 | [diff] [blame] | 7 | |
| 8 | allow netutils_wrapper system_file:file { execute execute_no_trans }; |
| 9 | allow netutils_wrapper proc_net:file { open read getattr }; |
| 10 | allow netutils_wrapper self:rawip_socket create_socket_perms; |
| 11 | allow netutils_wrapper self:udp_socket create_socket_perms; |
| Benjamin Gordon | 9b2e0cb | 2017-11-09 15:51:26 -0700 | [diff] [blame] | 12 | allow netutils_wrapper self:global_capability_class_set net_admin; |
| Sandeep Patil | c6d8902 | 2017-04-14 19:06:56 -0700 | [diff] [blame] | 13 | # ip utils need everything but ioctl |
| 14 | allow netutils_wrapper self:netlink_route_socket ~ioctl; |
| 15 | allow netutils_wrapper self:netlink_xfrm_socket ~ioctl; |
| 16 | |
| 17 | # For netutils (ndc) to be able to talk to netd |
| 18 | allow netutils_wrapper netd_socket:sock_file { open getattr read write append }; |
| 19 | allow netutils_wrapper netd:unix_stream_socket { read getattr connectto }; |
| 20 | |
| 21 | # For /data/misc/net access to ndc and ip |
| 22 | r_dir_file(netutils_wrapper, net_data_file) |
| 23 | |
| 24 | domain_auto_trans({ |
| 25 | domain |
| 26 | -coredomain |
| 27 | -appdomain |
| 28 | }, netutils_wrapper_exec, netutils_wrapper) |