From ab7dfabb611ce4b1c32abbf91a467f098ab0188b Mon Sep 17 00:00:00 2001
From: Lorenzo Colitti <lorenzo@google.com>
Date: Mon, 5 Aug 2013 15:32:56 +0900
Subject: [PATCH] Fix clatd, broken by selinux policing /dev/tun

Bug: 10175701
Change-Id: I185df22bdbaafd56725760ec6c71340b67455046
---
 clatd.te      | 8 ++++++++
 file_contexts | 1 +
 netd.te       | 4 ++++
 3 files changed, 13 insertions(+)
 create mode 100644 clatd.te

diff --git a/clatd.te b/clatd.te
new file mode 100644
index 000000000..ebbb79ca8
--- /dev/null
+++ b/clatd.te
@@ -0,0 +1,8 @@
+# 464xlat daemon
+type clatd, domain;
+permissive clatd;
+type clatd_exec, exec_type, file_type;
+
+init_daemon_domain(clatd)
+net_domain(clatd)
+unconfined_domain(clatd)
diff --git a/file_contexts b/file_contexts
index 2161e8ebd..81b9da976 100644
--- a/file_contexts
+++ b/file_contexts
@@ -151,6 +151,7 @@
 /system/bin/ping    u:object_r:ping_exec:s0
 /system/bin/dnsmasq     u:object_r:dnsmasq_exec:s0
 /system/bin/hostapd     u:object_r:hostapd_exec:s0
+/system/bin/clatd	u:object_r:clatd_exec:s0
 #############################
 # Vendor files
 #
diff --git a/netd.te b/netd.te
index 8636af133..f98be3d3c 100644
--- a/netd.te
+++ b/netd.te
@@ -47,6 +47,10 @@ allow netd hostapd:process signal;
 domain_auto_trans(netd, dnsmasq_exec, dnsmasq)
 allow netd dnsmasq:process signal;
 
+# Allow netd to start clatd in its own domain
+domain_auto_trans(netd, clatd_exec, clatd)
+allow netd clatd:process signal;
+
 # Support netd running mdnsd
 # TODO: prune this back further
 allow netd ctl_default_prop:property_service set;
-- 
GitLab