Home | History | Annotate | Download | only in sepolicy 
      1 # Network utilities (radio process)
      2 type netmgrd, domain, device_domain_deprecated;
      3 type netmgrd_exec, exec_type, file_type;
      4 
      5 # Uses network sockets.
      6 net_domain(netmgrd)
      7 allowxperm netmgrd self:udp_socket ioctl priv_sock_ioctls;
      8 
      9 # Talk to qmuxd (qmux_radio)
     10 qmux_socket(netmgrd)
     11 
     12 # Runs commands via sh.
     13 allow netmgrd shell_exec:file rx_file_perms;
     14 
     15 # Starts as (root,radio) changes to (radio,radio)
     16 allow netmgrd self:capability { setuid setgid net_admin net_raw setpcap };
     17 
     18 # Started by init
     19 init_daemon_domain(netmgrd)
     20 
     21 allow netmgrd smem_log_device:chr_file rw_file_perms;
     22 
     23 # Access to /proc/sys/net/*
     24 allow netmgrd proc_net:file rw_file_perms;
     25 allow netmgrd proc_net:dir r_dir_perms;
     26 
     27 # Runs /system/bin/toolbox
     28 allow netmgrd system_file:file rx_file_perms;
     29 allow netmgrd vendor_file_type:file rx_file_perms;
     30 
     31 allow netmgrd self:netlink_socket create_socket_perms_no_ioctl;
     32 allow netmgrd self:netlink_route_socket nlmsg_write;
     33 allow netmgrd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read };
     34 
     35 # b/17065650
     36 allow netmgrd self:socket { create ioctl read write };
     37 allowxperm netmgrd self:socket ioctl msm_sock_ipc_ioctls;
     38 
     39 # CONFIG_MODULES not set in shamu_defconfig
     40 dontaudit netmgrd self:capability sys_module;
     41 
     42 # Set net_radio properties
     43 set_prop(netmgrd, net_radio_prop)
     44 
     45 # Permission to run netd commands
     46 allow netmgrd netd_socket:sock_file write;
     47 
     48 #Allow access to files associated with netd
     49 allow netmgrd net_data_file:file r_file_perms;
     50 allow netmgrd net_data_file:dir r_dir_perms;
     51 
     52 allow netmgrd shell_exec:file { execute r_file_perms execute_no_trans };
     53 
     54 r_dir_file(netmgrd, sysfs_ssr);
     55 
     56 allow netmgrd sysfs:file write;
     57 allow netmgrd sysfs_usb:file write;
     58 
     59 allow netmgrd kernel:system module_request;
     60 
     61 # talk to cnd
     62 unix_socket_connect(netmgrd, cnd, cnd)
     63 
     64 # execute toybox/toolbox
     65 allow netmgrd toolbox_exec:file rx_file_perms;
     66 
     67 #Allow netmgrd to use wakelock
     68 wakelock_use(netmgrd)
     69