1 # Network utilities (radio process) 2 type netmgrd, domain, domain_deprecated; 3 type netmgrd_exec, exec_type, file_type; 4 5 # Started by init 6 init_daemon_domain(netmgrd) 7 8 # Triggers a sys_module denial, but kernel has CONFIG_MODULES=n. 9 dontaudit netmgrd self:capability sys_module; 10 11 # Starts as (root,radio) changes to (radio,radio) 12 allow netmgrd self:capability { setuid setgid net_admin net_raw }; 13 14 allow netmgrd self:udp_socket { create ioctl }; 15 # rawip_socket for iptables 16 allow netmgrd self:rawip_socket create_socket_perms; 17 allow netmgrd self:netlink_socket create_socket_perms; 18 allow netmgrd self:netlink_route_socket { create_socket_perms nlmsg_write nlmsg_read }; 19 20 # Talk to qmuxd (qmux_radio) 21 qmux_socket(netmgrd) 22 23 # Runs commands via sh. 24 allow netmgrd shell_exec:file rx_file_perms; 25 26 # Runs /system/bin/ip addr flush dev <device> commands. 27 allow netmgrd system_file:file rx_file_perms; 28 29 # Run toolbox. 30 allow netmgrd toolbox_exec:file rx_file_perms; 31 32 # Set net.rmnet0.* values 33 set_prop(netmgrd, radio_prop) 34 auditallow netmgrd radio_prop:property_service set; 35 set_prop(netmgrd, net_radio_prop) 36 37 # Access to /proc/sys/net/* 38 allow netmgrd proc_net:file rw_file_perms; 39 allow netmgrd proc_net:dir r_dir_perms; 40 41 # Let netmgrd access /dev/mdm node (modem driver) 42 allow netmgrd radio_device:chr_file r_file_perms; 43
