1 typeattribute netutils_wrapper coredomain; 2 3 r_dir_file(netutils_wrapper, system_file); 4 5 # For netutils (ip, iptables, tc) 6 allow netutils_wrapper self:capability net_raw; 7 8 allow netutils_wrapper system_file:file { execute execute_no_trans }; 9 allow netutils_wrapper proc_net:file { open read getattr }; 10 allow netutils_wrapper self:rawip_socket create_socket_perms; 11 allow netutils_wrapper self:udp_socket create_socket_perms; 12 allow netutils_wrapper self:capability net_admin; 13 # ip utils need everything but ioctl 14 allow netutils_wrapper self:netlink_route_socket ~ioctl; 15 allow netutils_wrapper self:netlink_xfrm_socket ~ioctl; 16 17 # For netutils (ndc) to be able to talk to netd 18 allow netutils_wrapper netd_socket:sock_file { open getattr read write append }; 19 allow netutils_wrapper netd:unix_stream_socket { read getattr connectto }; 20 21 # For /data/misc/net access to ndc and ip 22 r_dir_file(netutils_wrapper, net_data_file) 23 24 domain_auto_trans({ 25 domain 26 -coredomain 27 -appdomain 28 }, netutils_wrapper_exec, netutils_wrapper) 29
