1 # userspace wifi access points 2 type hostapd, domain; 3 type hostapd_exec, exec_type, vendor_file_type, file_type; 4 5 init_daemon_domain(hostapd) 6 7 net_domain(hostapd) 8 allow hostapd self:capability { net_admin net_raw }; 9 10 # hostapd learns about its network interface via sysfs. 11 allow hostapd sysfs:file r_file_perms; 12 # hostapd follows the /sys/class/net/wlan0 link to the PCI device. 13 allow hostapd sysfs:lnk_file r_file_perms; 14 15 # Allow hostapd to access /proc/net/psched 16 allow hostapd proc_net:file { getattr open read }; 17 18 # Various socket permissions. 19 allowxperm hostapd self:udp_socket ioctl priv_sock_ioctls; 20 allow hostapd self:netlink_socket create_socket_perms_no_ioctl; 21 allow hostapd self:netlink_generic_socket create_socket_perms_no_ioctl; 22 allow hostapd self:packet_socket create_socket_perms_no_ioctl; 23 allow hostapd self:netlink_route_socket nlmsg_write; 24 25 # hostapd can read and write WiFi related data and configuration. 26 # For example, the entropy file is periodically updated. 27 allow hostapd wifi_data_file:file rw_file_perms; 28 r_dir_file(hostapd, wifi_data_file) 29 30 # hostapd wants to create the directory holding its control socket. 31 allow hostapd hostapd_socket:dir create_dir_perms; 32 # hostapd needs to create, bind to, read, and write its control socket. 33 allow hostapd hostapd_socket:sock_file create_file_perms; 34
