1 # Network utilities (radio process) 2 type netmgrd, domain; 3 type netmgrd_exec, exec_type, file_type; 4 5 # Started by init 6 init_daemon_domain(netmgrd) 7 8 # Triggers a sys_module denial, but kernel has CONFIG_MODULES=n. 9 dontaudit netmgrd self:capability sys_module; 10 11 # Starts as (root,radio) changes to (radio,radio) 12 allow netmgrd self:capability { setuid setgid net_admin net_raw }; 13 14 allow netmgrd self:udp_socket { create ioctl }; 15 # rawip_socket for iptables 16 allow netmgrd self:rawip_socket create_socket_perms; 17 allow netmgrd self:netlink_socket create_socket_perms; 18 allow netmgrd self:netlink_route_socket { create_socket_perms nlmsg_write nlmsg_read }; 19 20 # Talk to qmuxd (qmux_radio) 21 qmux_socket(netmgrd) 22 23 # Runs commands via sh. 24 allow netmgrd shell_exec:file rx_file_perms; 25 26 # Runs /system/bin/ip addr flush dev <device> commands. 27 allow netmgrd system_file:file rx_file_perms; 28 29 # Talk to init over the property socket 30 unix_socket_connect(netmgrd, property, init) 31 # Set net.rmnet0.* values 32 allow netmgrd radio_prop:property_service set; 33 auditallow netmgrd radio_prop:property_service set; 34 allow netmgrd net_radio_prop:property_service set; 35 36 # Access to /proc/sys/net/* 37 allow netmgrd proc_net:file rw_file_perms; 38 allow netmgrd proc_net:dir r_dir_perms; 39 40 # Let netmgrd access /dev/mdm node (modem driver) 41 allow netmgrd radio_device:chr_file r_file_perms; 42
