1 # Network utilities (radio process) 2 type netmgrd, domain; 3 type netmgrd_exec, exec_type, file_type; 4 5 # Started by init 6 init_daemon_domain(netmgrd) 7 8 # Uses network sockets. 9 net_domain(netmgrd) 10 11 # Starts as (root,radio) changes to (radio,radio) 12 allow netmgrd self:capability { setuid setgid net_admin net_raw }; 13 14 # Triggers a sys_module denial, but kernel has CONFIG_MODULES=n. 15 dontaudit netmgrd self:capability sys_module; 16 17 allow netmgrd self:netlink_socket create_socket_perms; 18 allow netmgrd self:netlink_route_socket nlmsg_write; 19 20 # Talk to qmuxd (qmux_radio) 21 qmux_socket(netmgrd) 22 23 # Runs commands via sh. 24 # TODO: Convert to direct exec of /system/bin/ip and any other helpers. 25 allow netmgrd shell_exec:file rx_file_perms; 26 27 # Runs /system/bin/ip addr flush dev <device> commands. 28 allow netmgrd system_file:file rx_file_perms; 29 30 # Talk to init over the property socket 31 unix_socket_connect(netmgrd, property, init) 32 # Set net.rmnet0.* values 33 allow netmgrd radio_prop:property_service set; 34 auditallow netmgrd radio_prop:property_service set; 35 allow netmgrd net_radio_prop:property_service set; 36 37 # Access to /proc/sys/net/* 38 allow netmgrd proc_net:file write; 39
