From 3ddaa63bde607d7f980046dd6ee074a0f267a044 Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Thu, 15 Nov 2018 10:32:45 -0800
Subject: [PATCH] racoon: allow ioctl TUNSETIFF

Used by
https://android.googlesource.com/platform/external/ipsec-tools/+/bf16586a33b1432a11526754523fceb62944dc1c/main.c#116

Addresses the following denial:

audit(0.0:8126): avc: denied { ioctl } for comm="racoon" path="/dev/tun" dev="tmpfs" ino=25329 ioctlcmd=0x54ca scontext=u:r:racoon:s0 tcontext=u:object_r:tun_device:s0 tclass=chr_file permissive=0

Test: policy compiles.
Change-Id: Ia26077d4a9e810c7006d4b979d6b7e9ca154b485
---
 public/racoon.te | 1 +
 1 file changed, 1 insertion(+)

diff --git a/public/racoon.te b/public/racoon.te
index 7d1247a81..688874024 100644
--- a/public/racoon.te
+++ b/public/racoon.te
@@ -10,6 +10,7 @@ allowxperm racoon self:udp_socket ioctl { SIOCSIFFLAGS SIOCSIFADDR SIOCSIFNETMAS
 binder_use(racoon)
 
 allow racoon tun_device:chr_file r_file_perms;
+allowxperm racoon tun_device:chr_file ioctl TUNSETIFF;
 allow racoon cgroup:dir { add_name create };
 allow racoon kernel:system module_request;
 
-- 
GitLab